Isolating a sub-environment of UnityScript for users

Hi all

I want to allow users to run some commands, store some variables, etc in UnityScript and also have some commands available that affect the rest of the UnityScript environment. Just really basic stuff. Of course I want to do this securely, that is without any way for the user to "escape" this sub-environment.

So I guess what I'd need to do is disallow access to the global object and all other objects except those within a certain scope, and restrict the use of standard keywords (eg. eval). Any other things that could pose a security risk?

I'm also not too keen on making my own JavaScript engine. So if the above aren't possible, my next question is what is there in terms of JavaScript engines that could be striped out and plugged into Unity?

And has anyone had any experience in doing any of these things before?

Thank you all!

 

I'm non sure, but probably, Code Access Security could be suitable for you.
Wiki: http://en.wikipedia.org/wiki/Code_Access_Security
MSDN: http://en.wikipedia.org/wiki/Code_Access_Security

 

That is what I'm looking for, though do you know if it could be used in unityscript? It looks like it's just for .NET.

 

I thinks yes, as well as unityscripts can use other .NET classes and attributes. But I never tried to use CAS in Unity projects (to be honest I used this technoligy only couple ot times in other not-unity projects).
Let me know if it will or not will work

 

Cool, ok I'll see what I can uncover. Thank for the help and I'll let you know what I find!