4 ms·
Figma has a great blog post on some different user-generated javascript isolation approaches [1]. They discuss this iframe approach, running a webassembly javas
by arkadiyt 4y ago
Figma has a great blog post on some different user-generated javascript isolation approaches [1]. They discuss this iframe approach, running a webassembly javascript interpreter (also suggested in these thread comments), and using javascript realms. In the post they originally opted for javascript realms but there's an edit at the top - it seems like they ended up switching to the webassembly javascript interpreter approach.
[1]: https://www.figma.com/blog/how-we-built-the-figma-plugin-system/ https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...
- turblety 4y agoThanks for sharing the link. That was an amazing read. I originally tried the proxy method (I didn't know about Realms though, they seem cool), and I think I got pretty far. At least, I couldn't find a way to get to the constructor, and access the main scope. But I'm just not confident you can really isolate code on the same domain that your main code run's in. That's why I ended up moving to a web worker on a different origin. It also comes with the plus that you can kill a hanging web work, as it's run in a different process. Going to be keeping a close eye on Realm though!
- naugtur 4y agoAgoric moved forward and Realms gave way to SES https://github.com/endojs/endo/tree/master/packages/ses https://github.com/endojs/endo/tree/master/packages/ses And Endo is a set of tools (being) built around it to make it more practical for particular usecases