3 ms·
> User code is executed in a web worker to minimize the risk of malicious use Can you expand on this a bit? I have something that I would love to enable user p
by a1o 2y ago
> User code is executed in a web worker to minimize the risk of malicious use
Can you expand on this a bit? I have something that I would love to enable user plugins by using JS eval or something but I am too afraid of someone doing evil stuff to bring the feature in-place.
- throwup238 2y agoThe only way for a worker to communicate with the rest of the browser context is by using the `postMessage` method. The host code has to listen and respond via the `onmessage` handler, so the worker is unable to do anything that you don't explicitly implement in your `onmessage` handler. You still have to make sure the API you expose to the user plugins aren't exploitable.
- a1o 2y agoThank you for the explanation, I was not familiar with this method, it looks interesting, a tradeoff between flexibility and safety vs iframe.
- stankot 2y agoIt is probably the safest to use an iframe (like CodePen for example), but I was looking for a simpler solution. I ended up with a web worker as it has a completely separate scope (no access to window object). However, it still has access to a bunch of browser APIs, so I also have a list of “forbidden” words. It is not ideal, (as proved in one of the comments below) but it is a middle ground that seemed fine for my usecase.