0

As part of a research project, I am currently investigating the sandboxing of third-party scripts using the Secure EcmaScript implementation of the Google Caja project (https://code.google.com/p/es-lab/wiki/SecureEcmaScript, https://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/ses). I managed to execute the Google Maps application in such a sandbox, i.e. the Google Maps API v3 (https://maps.googleapis.com/maps/api/js) and subsequently loaded scripts are executed in a controlled environment. However, in order to make this work, I had to perform two modifications in the first script that is loaded by the Google Maps application (at the time of writing, this was https://maps.gstatic.com/intl/en_us/mapfiles/api-3/8/2/main.js). Without modifications, the application fails to run because the code is not ECMAScript 5 strict mode compliant. Concretely, following code fragment occurs somewhere in the file:

R.cf=function(){return this}().navigator&&-1!=ha.userAgent[Mc]()[tb]("msie");

In strict mode, function(){return this} returns undefined, causing the property access for "navigator" to throw an error. In non-strict mode, the function would return the global "window" object. I found one more instance where such a situation causes an error in strict mode.

At first, I found it surprising that the Google Maps application is not strict mode compliant. As far as I know, there are only advantages to the usage of strict mode. However, I reckon that the original code might be strict mode compliant, but that the transformations done by the minification compiler remove the compliance. From a security point of view, it is very useful to be able to execute a script in a controlled manner. For instance, this would prevent security violations when an external script has been compromised and its functionality altered. Therefore, I think it would be very useful to be able to execute the Google Maps application inside such a sandbox. However, as the Google Caja implementation of Secure EcmaScript relies on the limitations imposed by strict mode to guarantee its functionality, it requires a Google Maps application that is strict mode compliant.

So my question is: will a strict mode compliant version of the Google Maps application be available soon? Or will the current Google Maps application be replaced by a compliant one?

With kind regards,

Yoran

1 Answer 1

1

Seems like you should add this to the Maps API issue tracker

http://code.google.com/p/gmaps-api-issues/

... note Google rarely comment on upcomming features. But by adding to the issue tracker. you 1) allow other developers to 'vote' on the suggestion - increasing its 'importance' to google developers and 2) allow you to get notifications if google do anything about it.

2
  • Ok thanks for the reply. Earlier I had posted my question on the mailing list ([email protected]) but it was denied as it is a technical question and therefore more suited to be posted on StackOverflow instead. I have taken your advice and issued a feature request on the issue tracker. Hopefully I will get a reply from Google.
    – yorbro
    Mar 15, 2012 at 9:43
  • I could not find it in the issue tracker. Do you have a link?
    – Blaise
    Apr 17, 2012 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.