Intuify

Intuify

Documentation

Logic & flow2 min read

Custom JS limits & security

Sandboxing, blocked globals, and when to use Web Service blocks instead.

On this page (6 sections)

Custom JavaScript runs in a tightly scoped environment. This page lists everything the runtime blocks today (and why), so authors don't waste time chasing features that won't ever ship.

Blocked globals#

The builder's script validator and the runtime sandbox both shadow these globals. Referencing them in custom JS produces a builder warning today and will throw inside the sandbox once it ships:

GlobalWhy blocked
windowBypasses the API surface — use Intuify.survey.*.
documentDOM mutations break the engine's render contract.
localStoragePersistent data must go through setVariable.
sessionStorageSame — use survey variables.
fetchExternal calls belong on Web Service flow blocks.
XMLHttpRequestSame.
evalDefeats the sandbox.
FunctionSame.
parent, topPrevents script-driven iframe escapes.
framesSame.
openerSame.

The full list lives in src/lib/script-validation.ts and is kept in sync with the runtime sandbox so the builder warns about anything that will fail at runtime.

What custom JS can do#

  • Read and write the survey's variables (setVariable, getVariable).
  • Read the current question, its choices/rows/columns, and the resolved text.
  • Read and write any answer on the current page through setResponse.
  • Read URL query parameters captured at session start.
  • Resolve piped tokens against the current snapshot.
  • Inspect plugin payloads (getQuestionPayload) for migration / debug work.

What custom JS cannot do (phase 1)#

  • Navigate the survey (advance / goBack / terminate land with the sandbox).
  • Mutate the DOM directly.
  • Call external services.
  • Read or write other respondents' data.
  • Persist anything across sessions.
  • Override server-side variables in the server-driven respondent runtime (writes are no-ops there today; reads still work).

Security expectations#

  • Treat custom JS as untrusted input the same way you would treat embedded HTML. Don't paste scripts you don't fully understand.
  • The sandbox enforces a hard timeout to prevent runaway loops.
  • Scripts can't escape into the survey builder UI or other open tabs.
  • All runtime data exposed (questions, choices, variables, URL params) is already visible to the respondent — the API doesn't widen the attack surface, it just makes that data easier to consume.

When to use Web Service blocks instead#

If you need to call an API, log to an analytics endpoint, or fetch external data, use a Web Service flow block. Those run on the server during navigation, can authenticate with API keys, and feed results back into the engine as variables — none of which custom JS is allowed to do.

Use custom JS only for read/transform/write on the survey state itself; everything else belongs in the flow editor.


Was this page helpful?