Explore potential exploits of the REPL wrt node-webkit application

[qq99]

How possible is it to sandbox the REPL, what's the scope of the potential exploits? This one might be a fun one to play with :)

[jamiees2]

nwjs/nw.js#534
Adding nwdisable and nwfaketop should disable everything for the iframe.

The potential exploits are huge, for one thing nw has access to the filesystem i believe and the network, and process. With some obfuscated codewriting, you could easily make the program download and execute an executable from the internet, which obviously is a massive security concern.

The simple fact that require() is available to the iframe makes it a gaping security hole.