5

Is to disable the global variable in the function that I want.

I would make like Expenssion of Adobe After Effect

example code :

function privateFunction(){
    return window;
}

then normally :

result : Window Object

but I want then :

result : undefined

What should I do?

please help me

I want blocking global variable access in function;

Jeong SangCheol
  • 113
  • 1
  • 2
  • 8

2 Answers2

4

You need to wrap everything in a closure:

    (function() {
        var window = 'foo';
        function privateFunction(){
            return window;
        }
    
        console.log(privateFunction());
    })();
Donal
  • 31,121
  • 10
  • 63
  • 72
4

Shadow the global variable by a local one:

function privateFunction() {
    var window;
    return window; // not the Window, but undefined now
}
Bergi
  • 630,263
  • 148
  • 957
  • 1,375
  • It solved the example problem. However, it is possible to block all Math, document, HTMLElemnt ... No easier way? – Jeong SangCheol Aug 21 '14 at 11:30
  • No. There's not way to restrict scope access for arbitrary functions. Not sure why you would want to do that, buy you might want to have a look at [web workers](https://stackoverflow.com/questions/10653809/making-webworkers-a-safe-environment) – Bergi Aug 21 '14 at 11:33
  • yes.. i'd want like Web Worker... T_T But that is async.. T_T – Jeong SangCheol Aug 21 '14 at 11:38
  • Everything is async in JS, that shouldn't be an issue. But again, what do you need this for? Do you want to run untrusted code? – Bergi Aug 21 '14 at 11:40
  • 1 Yes!! That's it! actually, I will make expression script for user. as you are saying, that is untrusted script.. – Jeong SangCheol Aug 22 '14 at 06:14
  • Well, I know Browser working is Single Thread. But why every JS is async? did i say wrong? i means async = Non block process – Jeong SangCheol Aug 22 '14 at 06:23
  • I mean that many important things in JS are built for an async processing model, such as DOM events or communication with other environments. However, many patterns have evolved for this, so it shouldn't be a big issue if running untrusted scripts is async as well. – Bergi Aug 22 '14 at 10:51
  • This doesn't work --- bare variable accesses still access the window variable: `function p() { var window = null; fnord = 7; }` still assigns 7 to the global `window.fnord`. – David Given Sep 06 '15 at 10:24
  • @DavidGiven: Of course it does not prevent the user from accessing other global variables on the global object. But OP was only asking for making `window` be `undefined` in this scope, and that works :-) – Bergi Sep 06 '15 at 11:13
  • Actually the OP was asking to block *all* global variables, and using window as an example. (If anyone knows how to do this, I want to know...) – David Given Sep 06 '15 at 11:28
  • @DavidGiven: Well either you can collect them all and shadow them all, or you should execute your script in a different environment. – Bergi Sep 06 '15 at 11:42
  • I haven't found out a way to create such an environment, unfortunately. There must be one somewhere... – David Given Sep 06 '15 at 11:43
  • @DavidGiven: Webworkers or iframes do have more-or-less isolated environments, also in node you can create them explicitly. What exactly are you trying to do? – Bergi Sep 06 '15 at 11:47
  • Yeah, but that's basically running the function in a completely separate VM, which is not what I want. What I'm looking for is a way to override the global context for a particular function to point it at a custom dict. This is trivial in Lua... – David Given Sep 06 '15 at 18:03
  • @DavidGiven: scope is private and non-dynamic (and cannot be messed with) in JS, you cannot do that (JS is not Lua). You'll have to create the function in the context that you want. In node, you can use the [vm module](https://nodejs.org/api/vm.html) to run code with a custom global (although it's not really a VM with a separate process). – Bergi Sep 06 '15 at 18:08
  • Well, how do I specify the global context when creating a function, then? `new Function` only takes two parameters, neither of which is an options object... – David Given Sep 06 '15 at 18:10
  • @DavidGiven: The JS language doesn't have an API for that - it's designed to run in a single environment only. The [node `vm.runInThisContext`](https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_options) does use some lower-level implementation-specifc api. Maybe ES7 will include methods to create new realms. – Bergi Sep 06 '15 at 18:20
  • You could always just redeclare all the 'dangerous' global objects inside the function. var Math, document, window; etc... – Michael Westcott Apr 24 '16 at 07:24