4 ms·
As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation.
by kettlecorn 10mo ago
As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation.
In a browser environment it's much easier to sandbox Wasm successfully than to sandbox JS.
- MobiusHorizons 10mo agoThat’s very interesting! Have they documented the reasoning for that approach? I would have expected iframes to be both simpler and faster sandboxing mechanism especially in compute bound cases. Maybe the communication overhead is too high in their workload? EDIT: found this from your other comment: https://www.figma.com/blog/an-update-on-plugin-security/ https://www.figma.com/blog/an-update-on-plugin-security/ they do not address any alternatives considered.