quickjs-emscripten

The library was inspired by Figma’s blog posts about their plug-in system: https://github.com/justjake/quickjs-emscripten#background

If you need to call into user-generated Javascript synchronously or have greater control over the sandbox environment, you can use WebAssembly to run a Javascript interpreter: https://github.com/justjake/quickjs-emscripten#quickjs-emscr... QuickJS in WebAssembly is much slower than your browser's native Javascript runtime, but possibly faster than async calls using postMessage. As an added bonus, it can make async functions in the host appear to be synchronous inside the sandbox using asyncify: https://github.com/justjake/quickjs-emscripten#async-on-host...

You can use One Weird Trick with generator functions to make your code "generic" over synchronicity. I use this technique to avoid needing to implement both sync and async versions of some functions in my quickjs-emscripten library. The great part about this technique as a library author is that unlike choosing to use a Promise return type, this technique is invisible in my public API. I can write a function like `export function coolAlgorithm(getData: (request: I) => O | Promise<O>): R | Promise<R>`, and we get automatic performance improvement if the caller's `getData` function happens to return synchronously, without mystery generator stuff showing up in the function signature. Helper to make a function that can be either sync or async: https://github.com/justjake/quickjs-emscripten/blob/ff211447... Uses: https://cs.github.com/justjake

QuickJS compiled to WASM seems like a pretty nice way of getting a sandboxed js environment: https://github.com/justjake/quickjs-emscripten. Curious if people have seen any other routes to doing it via WASM.

Tangentially related: I maintain a library for using QuickJS, a JS interpreter with more modern language support, from NodeJS or the web called QuickJS-Emscripten: https://github.com/justjake/quickjs-emscripten This was inspired by seeing Duktape WASM build on HN (https://github.com/maple3142/duktape-eval) and Figma's blogposts about building a Javascript plugin runtime: - How Figma built the Figma plugin system: Describes the LowLevelJavascriptVm interface (https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...) - An update on plugin security: Figma switches to QuickJS (https://www.figma.com/blog/an-update-on-plugin-security/)

Have you considered adding a capability for plugins to draw HTML into an <iframe sandbox>? I'm always pondering such features, but I'm wary of letting a plugin potentially block the CPU forever with custom <script> elements. I have a solution to plugin CPU blocking for pure API plugins (https://github.com/justjake/quickjs-emscripten) but not a way to meld it safely with HTML access.

Wow, this is a great resource! I’ve been dealing with a lot of these issues with a JS sandbox library I’m building quickjs-emecripten. I want to offer a ton of different build variants of my core WASM file. Here’s what I tried: https://github.com/justjake/quickjs-emscripten/blob/master/t... This approach works great for NodeJS, but once I ran a test bundle I found that Webpack (and bundlephobia) included all the base64 “release” variants instead of lazy-loading the import statements. Bummer. I assumed this because Typescript on its own compiled import to Promise.resolve(require(…)), so it’s good to know that most bundlers will STILL get this wrong even if I’m emitting ES6 module import syntax. Yikes! I need to bite the bullet and start using Rollup to emit a slew of separate entry points. Oy veh. Anyways A+++ would read again. This will s

I like Make, and use it in personal JavaScript ecosystem projects that do actually need to build things with interdependency (eg https://github.com/justjake/quickjs-emscripten/blob/master/M...). I’ve also seen Makefiles grown to be horrendous monstrosities masquerading as command-line tools; for about a year at Airbnb we used a 1000+ line Makefile as the main tool for fiddling with Kubernetes cuz one of our senior engineers didn’t like Ruby, and I’ve seen another one get close to that level of cravenness. What I learned from supporting Make and shell among a few different audiences is that most developers have no interest in how to write or maintain shell-like tooling. They forget or mess up quoting rules constantly, and eschew learning things and good design in these tools to a much greater degree than in their “normal” work in Java/Pyth

If you want to use QuickJS in the browser and/or NodeJS for running untrusted code, building plugin systems, etc, I have a library here that wraps a WASM build of QuickJS: https://github.com/justjake/quickjs-emscripten#quickjs-emscr... I believe Figma uses QuickJS for their plugin system.

I want the web to be more end-user programmable. Web apps big and small should offer plugin extension mechanisms! Ideally plug-ins are frictionless to author, and powerful enough to build fun UIs. Today, only really big premier apps like Figma and Google Docs have this kind of feature. One problem is that it’s very difficult for an app to run arbitrary, untrusted user code in a way that’s secure and efficient, especially in the browser. Apps need to worry about XSS and unintended remote code execution, much less try adding those things as a feature. I started working on a Typescript/WebAssembly library around the QuickJS JavaScript runtime to address this need. QuickJS runs modern ES2020 and provides an API for the host process to set CPU and memory budgets for the execution environment, which is completely sandboxed. My work so far expo