How does GoRules prevent XSS?

[justin0108]

Hi,
We are evaluating whether GoRules is suitable for our project and 1 of the security question raised was how does GoRules prevent XSS since it has a FunctionNode that can accept Javascript input.
Would appreciate some advice on this as the people in our team is very new to Rust.

[stefan-gorules]

Hi @justin0108,

XSS is not applicable to GoRules as it is a business rules engine. XSS is applicable for frontend running applications, GoRules runs on the backend. The JavaScript is evaluated inside QuickJS (similar to V8, but smaller) and each evaluation spawns a separate context / isolate. We don't use eval or anything similar. Each function runs in it's own context and it doesn't "leak".

Hopefully this answers your question, but if you can provide specific scenario that presents a concern happy to go through it.

[justin0108]

Thanks!
The answer has been a great help