Javascript [Electronic resources] : The Definitive Guide (4th Edition) نسخه متنی

1.7 JavaScript Security

Any time that programs (such as JavaScript
scripts, Visual Basic programs, or Microsoft Word macros) are
included within shared documents, particularly documents that are
transmitted over the Internet or by email, there is a potential for

viruses or other malicious programs. The
designers of JavaScript were aware of these security issues and took
care not to give JavaScript programs the power to perform damaging
acts. As described previously, for example, client-side JavaScript
programs cannot read local files or perform networking operations.

Because of the
complexity of the web-browser
environment, however, a number of security problems did arise in
early browser versions. In Netscape 2, for example, it was possible
to write JavaScript code that could automatically steal the email
address of any visitor to a page containing the code and then
automatically send email in the visitor's name, without the
visitor's knowledge or approval. This, and a number of other
security holes, has been fixed. Although there is no guarantee that
other security holes will not be found, most knowledgeable users are
comfortable letting modern browsers run the JavaScript code found in
web pages. Chapter 21 contains a complete
discussion of security in client-side JavaScript.