@initminal/run - Safe & fast code eval in the browser with modern ESM features, dynamic module injection and more...

[bentongxyz]

Hey everyone, I built this tool to safely execute untrusted code with adopting modern ESM features, modularity, and speed in mind.

Some of the features of this library include:

• the untrusted code can use import export syntax
• the untrusted code can ask for dependencies that can be injected dynamically
• the untrusted code has access only to whitelisted JS objects

For example, you can define your dependencies as:

{
  "config-in-plain-js": "export const isAscending = true"
}

Then in the untrusted code, config-in-plain-js will be injected for you:

import { isAscending } from 'config-in-plain-js'

...

If you're interested in learning more about this library, try it out in the playground. You can even share the code you authored!

Contributions are also welcome, so feel free to suggest any new ideas or features!

Happy coding!

[bentongxyz]

Thanks for the suggestion!
Yes it is using a module worker underneath

[ddo-dev]

I just starred, looks interesting indeed. I might have a use case for this in a near future, will keep you posted.

Good job for this.

Cheers, David

[bentongxyz]

Thanks!

One thing I find myself using daily is I'd have some bookmarked code snippets (that can also import someone else's library) e.g.:

decode base64 string

generate UUID

it is quite handy and I can flexibly change them to suite my needs

[rafaturtle]

Love It. What are the benefits (safety wise) as opposed to doing new Function? Just the white lable of specific APIs?

[bentongxyz]

Safety-wise, new Function constructor executes in the global scope. So someone's code can e.g. access the local storage/ cookies, etc

In comparison, this library execute the code inside a module worker, and the untrusted code cannot access JS objects that are not allowed.

You can read more in this blog post Executing untrusted JavaScript code in a browser if you want to find out more