Limiting JS Access

[TheyAreWaiting]

Hello,

I'm new to Godot and I'm investigating GodotJS with V8. I've gotten the test javascript file in the example to work:

const { Node, Variant } = require('godot');
const jc = require("jsb.core");

// declare your script class
class SimpleJSNode extends Node {
	speed = 0;

	_ready() {
		console.log("SimpleJSNode _ready");
	}
}

// export a property to Godot 
jc.export_(Variant.Type.TYPE_FLOAT)(SimpleJSNode.prototype, "speed");

But I'm wondering would people be able to change the javascript files in the pck so they can require FileAccess from Godot?

Is there a way to limit what the Javascript has access to? Like, could I just execute all of the Javascript in a sandbox that only has access to a few methods from GD Script?

Thanks!

[ialex32x]

GodotJS doesn't have such abilities for now. You can do almost anything exposed to the scripting layer in the Godot engine, like the gdscript. Maybe it's better to encrypt the pck files if you don't want others to modify them.

So far, sandbox isn't a planned feature. But some features are planned to be added in future versions which may help to improve this kind of security

• excluding some classes that are not allowed to be used in the shipping game
• support for JS minify/obfuscator tools (webpack/gulp)