Javascript Sandbox?
<p>Would it be possible to sandbox user-submitted Javascript by overriding various functions such as <code>alert</code>, <code>window.location</code>, and <code>eval</code>?</p>

<p>I'm not looking for a perfect solution. I'm sure some people would still find a way to rearrange divs to spell out swear words or something malicious, but if I could disable page redirects 100% reliably I would be mostly happy.</p>

<p>I tried in Chrome, and doing something like</p>

<pre><code>context={}; //use this to prevent `this` from being `window`
context.f=function(){
  var window=null,location=null,eval=function(){};
  console.log(window); //also the other two
};
context.f();
</code></pre>

<p>seems promising. If I replace the <code>console</code> line with user-submitted code (checking for paren balancing), would that be an absurdly bad idea or a mildly bad idea? On Chrome I can still break things by going through <code>this</code> to Function and redefining things, but that would be acceptable to me.</p>
