Question Regarding Restricting FileSystem Access to certain parts of the code

Related to the recent event-stream exploit (https://github.com/dominictarr/event-stream/issues/116)

The attacker used the fact `window.cordoba.file` is global and public access from anywhere in the code, as shown on this part of the injected malicious code:
``` javascript
if (window.cordova) try {
var e = cordova.file.dataDirectory;
resolveLocalFileSystemURL(e, function(e) {
e.getFile(t, {
create: !1
}, function(e) {
e.file(function(e) {
var t = new FileReader;
t.onloadend = function() {
return n(JSON.parse(t.result))
}, t.onerror = function(e) {
t.abort()
}, t.readAsText(e)
})
})
})
```

we are thinking different ways to prevent no-authorized part of the code to access the file system, but I wonder if there is any existing solution for that or you guys have already thought a possibility of doing so.

thanks,
matías

Start by reading the linked event-stream exploit and reviewing how the public window.cordova.file access is exposed. The issue names no repository files or tests; done would require deciding and documenting or implementing a viable way to prevent unauthorized code from accessing the file system.

Written by the indexing model from the issue text.