jslibs implements a SandboxEval( code [, queryCallback] [, operationLimitCount] ) however that is fairly limited in what it can do.

I've had an idea for a good Sandbox implementation, something similar to PHP's Runkit_Sandbox. However Soubok doesn't seam optimistic in being able to make it work.

The idea involves creating an actual Sandbox object which you can create an instance of and eval code on. From the look of SandboxEval's code it involves creating a JS scope, evaluating code, and then destroying the scope. To me it looks like a Sandbox object would be possible by creating a scope when the sandbox is created, evaulating code with .eval, and destroying the scope in the destructor which should be called whenever delete sandbox; or the GC gets to the object.

Soubok also doesn't think that some data types can be transmitted in between the Sandbox and the parent scope. However, in the browser Array === iframe.contentWindow.Array in other words iframes have different context, with a separate set of globals, and you can even take an array from one scope and work with it's data. It might take some work to make possible, but I would really like to explore the idea of a Runkit like Sandbox.

For reference here's some of the API idea for the Sandbox. If anyone is interested in trying this out on the C side don't hesitate to email dev@monkeyscript.org.

   1 var sb = new Sandbox;
   2 sb.eval('1+2'); // 3
   3 sb.exec('somefile');
   4 delete sb;
   5 
   6 var sb = new Sandbox;
   7 sb.eval('global.foo = 25;');
   8 sb.foo; // 25
   9 sb.bar = 34;
  10 sb.eval('global.bar'); // 34
  11 delete sb;
  12 
  13 var someEnclosedVariable = 35;
  14 var sb = new Sandbox({
  15         // Properties on this object will be applied to the global scope in the sandbox
  16         foo: 5,
  17         bar: function() someEnclosedVariable
  18 });
  19 sb.foo; // 5
  20 sb.eval('foo'); // 5
  21 sb.eval('global.foo'); // 5
  22 sb.eval('global.bar();'); // 35
  23 delete sb;