Support sandboxed script execution

[jgraham]

Allow running scripts in a sandbox environment, such that they have access to the DOM of page, but don't share js-level state with the page.

---

Preview | Diff

[sadym-chromium]

Started discussion offline:
Should the ObjectIDs for JS Node wrapper objects (and other DOM objects) be consistent in different sandboxes?

• yes, as user can use those nodes both in page realm and in sandbox.
• no, as the JS wrapper objects are different and pretending they are the same (share the same objectId) seems odd.

Potential solution for that would be excluding DOM instances from the serialization and consider serialization only from the ECMAScript realm perspective. Having that, another way to describe the node is needed.

Another solution is to add something like domID to DOM objects so that they can be referenced when needed across sandboxes.

Implementation-wise in CDP we face the need of somehow merging domains (Runtime (V8) runs evaluate but cannot serialize the result, as it doesn't know of DOM). Some of the CDP implementation approaches can be found in draft document BiDi Serialization in CDP.

Having that, we'd consider split DOM instances from it's JS wrappers, leaving the last in default serialization. And introducing DOM-specific serialization like describeDomObjects or decribeNodes.

[jgraham]

I created #176 for the discussion in that comment.

[bwalderman]

Looks like this algorithm doesn't quite align with the type of context sandbox map described above. Should this step check if context sandbox map contains source browsing context instead of name since it is a weak map whose keys are browsing contexts?

[bwalderman]

I suspect this should be an empty module map. If I'm understanding correctly, using the document's module map would mean that any names exported by module scripts on the page are now accessible in the sandbox if it imports the modules. This would break the isolation between the two realms.

[foolip]

@jgraham this is in draft still, do you want review, or what's needed to unblock it?

[foolip]

Is "atrthtmlibute" a typo?

[juliandescottes]

@jgraham this is in draft still, do you want review, or what's needed to unblock it?

It seems that part of this proposal was moved to #169 ?

[jgraham]

Yeah, let's just close this for now; we can always ressurect the changes if we want to use any of the more detailed text about how sandboxes work in terms of the platform.