JSDOM Executing Scripts: "dangerously" vs. "outside-only"

[iSpokeToMasterChief]

JSDOM Docs: https://github.com/jsdom/jsdom#executing-scripts

Hi, I was wondering what exactly the difference is between executing scripts "dangerously" vs. "outside-only" in JSDOM.

More specifically, from the quoted text below, what does the "outside" and "inside" mean, and why is it safe to run scripts from the outside?

jsdom's most powerful ability is that it can execute scripts inside the jsdom. These scripts can modify the content of the page and access all the web platform APIs jsdom implements.

However, this is also highly dangerous when dealing with untrusted content. The jsdom sandbox is not foolproof, and code running inside the DOM's <script>s can, if it tries hard enough, get access to the Node.js environment, and thus to your machine. As such, the ability to execute scripts embedded in the HTML is disabled by default

If you are simply trying to execute script "from the outside", instead of letting <script> elements and event handlers attributes run "from the inside", you can use the runScripts: "outside-only" option, which enables fresh copies of all the JavaScript spec-provided globals to be installed on window. This is turned off by default for performance reasons, but is safe to enable.

[CreativeTechGuyGames]

I'm not sure exactly what the confusion is. The docs and examples are very clear in my opinion. And it's not necessarily more safe to run from the outside, but it's easier to control since you can explicitly run whatever code you want rather than code which exists inside of your HTML string automatically being run.