privilege dropping possible in Javascript?

Question

I wonder if it would be possible to drop privileges in Javascript?

function takeAwaySetTimeout()
{
  var oldSetTimeout = window.setTimeout;
  window.setTimeout = function()
  {
    console.log("not working anymore!");
  };
}


setTimeout("console.log('this works');",0);  // "this works!"
takeAwaySetTimeout();
setTimeout("console.log('this works');",0);  // "not working anymore!"

unfortunatelly it seesm to me complicated as a simple delete window.setTimeout will bring back the priviledge! So for me this seems indicative to the fact that unfortunatelly Javascript would not provide for taken away privileges.

I am aware that the term privilege is somewhat borrowed. It is the background to the question that I would conceive any possiblity to workingly remove a [Native Code] function (= that the method .toSource() indicates its an function provided by the javascript engine) from being accessible in some part as a way to secure the code subjected to this limitation (the privileges are dropped) from being less of a safety concern.

clarification

I welcome your request for more clarity, and hope your will respond to it responsibly and de-hold "free" the question! Please also consider that having received indeed already two helpful answers shows that, there are people who were able to understand the question. Yet sure, if possible (something simply need background....) I also strive for broadening the understanding.

"It's a bit unclear how restricting access to native functions would give more security. Is this server-side or client-side JavaScript?"

1) it does not very much matter if client or server-side. Maybe a tiny little bit more important seems of course server-side. Because there is likely likely more functionality (i.e. writing to files, access files.....), more then maybe the more limited Javascript inside of Browser would be able to do (but consider new API's power ...and risks!)

2) maybe the choice for window.setTimeout() [Native function] is not perfect (for clarity), as maybe no direct security relationship is obvious. It has been used because it is well known and it is placeholder. see (3)

3) my reasoning is that each functionality that is provided to Javascript code is ambivalent. On the pro side, it enriches "what it can do?" positively and well-meaning code will use it responsible. Yet on the con side a functionality can mean access to things which when abused can cause security related stuff. An example would be that an external Javacript would do a XHR and post information to the server, potentially data that has private data (i.e. customers health state). If then for example it was possible to take away the XHR object better window.XMLHttpRequest the chances for such an abuse would be limited. Plainly "you cannot shoot somebody, not having a gun!". XHR for instance (maybe more clearly than setTimeout) is such a gun. If the "untrusted code" is not really needing XHR, then it is just good sense to take the risk away, by dropping this privilege/functionality.

4) I think (also in the context of the replies) this question has evolved. I think it is clear, yet please post comment if not so. While initially Juhana said:

It's a bit unclear[...]

I understand that it was not totally unclear, and hence now it might have reached enough clarity (please consider the helpful answers) to allow for "deholding"/"freeing the Question". Also if you found the question interesting enough to hold it, then now would be the time to find it interesting enough to upvote it ;)

Answer 1

There are so many ways to get the original function and blacklisting can't work because you'll miss something e.g.

Window.prototype.setTimeout.call(window,'alert(1)');

One solution to this problem is to create a whitelisted sandbox. I've created such a sandbox called MentalJS. This sandbox rewrites all your code with a suffix of $ for example alert(1) becomes alert$(1) this allows you to choose which functions/objects are allowed within the sandbox.

The code is available here: http://code.google.com/p/mentaljs/

and a demo: http://businessinfo.co.uk/labs/MentalJS/MentalJS.html

Answer 2

Google uses the Caja compiler in these situations. The unprivileged code is then run either in a server-side sandbox or (in browsers that support ES5) a client-side strict mode sandbox.