Question: I have couple of worker running background job. The method in this workers are like ~100 lines. What are general practices in optimizing and moving code to different files in Rails for Workers.

Answer: 
> 
> What are the ways in which an evil scripter can fool the check for restricted function us[age]?
> 
> 
> 

There are thousands of combinations, for example, with `eval()`, `new Function()`, combinations of `String.fromCharCode()` and `decodeURI()` (like in your example).

> 
> How might I prevent such mischief?
> 
> 
> 

Could you overload/shadow specific *bad* functions/objects/variables?

```
GM_openSQL_Connection = function() {
   warnUser();
};

```

To set a flag if the extension attempts to access a forbidden function or variable, simply have a `var isDangerous = false` which is set to `true` if a forbidden function is called or the [`get`](https://developer.mozilla.org/en/JavaScript/Reference/Operators/get)/[`set`](https://developer.mozilla.org/en/JavaScript/Reference/Operators/set) on a forbidden property is accessed/modified.

If the `isDangerous` is `true`, then you can mark that extension as potentially having dangerous function/property calls/accesses.
Trying to scan the script to detect whether it uses any of these interfaces is the wrong approach. It is too easy to evade through obfuscation, as you seem to be discovering. It's fundamentally insecure: there's no way to make it work.

Here is a better approach. Require the script-writer to include a manifest that declares what special APIs it needs access to. Then, run the script in a secure Javascript sandbox which only exposes the allowed APIs and APIs it has requested, but nothing more. If the script doesn't request `GM_openSQL_Connection` in its manifest, don't expose that API to the script.

Because Javascript is a dynamic language that allows monkey-patching and unrestricted access to the global object, it takes some doing to build a secure sandbox that restricts what APIs the script can access. Therefore, I recommend that you use an existing sandboxing solution. One approach is to run the user script in a sandbox, and give the sandboxed code a library that's full of stubs for the sensitive APIs, where the stubs just use `postMessage` to send a RPC request to your extension code. This avoids having references that cross the sandbox boundary, which is good as (depending upon sandboxing technology) those kind of references typically carry a substantial potential for security vulnerabilities.

Then, you can drive your user warnings based upon the contents of the manifest. Important: please think carefully about this from a user's perspective. Will ordinary users be able to make sense of the warnings? Will they be able to make sensible decisions? Will users be in a better position to make good decisions than you will? Will users be overwhelmed by constant warnings, and just start ignoring them and clicking 'ok' (the cry-wolf effect)?

For information on technology for Javascript sandboxing, please read the following question on IT Security: [How to scan Javascript for malicious code?](https://security.stackexchange.com/q/9779/971). In the future, you might get answers on the IT Security site for this kind of question.