Node.js prevent function inspection (toString)

问题

When javascript is run in the browser there is no need to try and hide function code because it is downloaded and viewable in source.

When run on the server the situation changes. There are use cases such as api where you want to provide users with functions to call without allowing them to view the code that which is run.

On our specific case we want to execute user submitted javascript inside node. We are able to sandbox node.js api however we would like to add our own api to this sandbox without users being able to toString the function to view the code which is run.

Does anyone have a pattern or know of a way of preventing users from outputting a functions code?

Update:

Here is a full solution (i believe) based on the accepted answer below. Please note that although this is demonstrated using client side code. You would not use this client side as someone can see the contents of your hidden function by simply reading the downloaded code (although it may provide some basic slow down to inspect the code if you have used a minify).

This is meant for server side use where you want to allow users to run api code within a sandbox env but not allow them to view what the api's do. The sandbox in this code is only to demonstrate the point. It is not an actual sandbox implementation.

// function which hides another function by returning an anonymous
// function which calls  the hidden function (ie. places the hidden
// function in a closure to enable access when the wraped function is passed to the sandbox) 
function wrapFunc(funcToHide) {
  var shownFunc = function() {
    funcToHide();
  };
  return shownFunc;
}

// function whose contents you want to hide
function secretFunc() {
  alert('hello');            
}

// api object (will be passed to the sandbox to enable access to
// the hidden function)
var apiFunc = wrapFunc(secretFunc);
var api = {};
api.apiFunc = apiFunc;

// sandbox (not an actual sandbox implementation - just for demo)
(function(api) {
  console.log(api);
  alert(api.apiFunc.toString());
  api.apiFunc();
})(api);

回答1:

If you wrap a callback in a function, you can use another function in that scope which is actually hidden from the callback scope, thus:

function hideCall(funcToHide) {
    var hiddenFunc = funcToHide;
    var shownFunc = function() {
        hiddenFunc();
    };
    return shownFunc;
}

Then run thusly

var shtumCallBack = hideCall(secretSquirrelFunc);
userCode.tryUnwindingThis(shtumCallBack);

The userCode scope will not be able to access secretSquirrelFunc except to call it, because the scope it would need is that of the hideCall function which is not available.

来源：https://stackoverflow.com/questions/12799996/node-js-prevent-function-inspection-tostring

标签

api

node.js

function

tostring