quickjs-emscripten

I’m not sure if wasm would be considered full process isolation but it does provide software based sandboxing. I’m referring to running quickjs in wasm by compiling it with emscripten. https://github.com/justjake/quickjs-emscripten

If you were not worried about preventing external requests and were okay with it being able to make requests as an arbitrary webpage unrelated to your site could if opened, then loading the code in an iframe with the sandbox="allow-scripts" attribute is enough. If you needed tighter sandboxing than that, then I think WebAssembly is your best bet because you can control exactly what APIs are exposed to a WebAssembly module. You could then let users submit WebAssembly modules or let them submit JS that will be run in a JS interpreter running in WebAssembly. I think https://github.com/justjake/quickjs-emscripten or https://github.com/fermyon/StarlingMonkey (used by https://github.com/bytecodealliance/ComponentizeJS) look good for that.

I’m the author of the underlying quickjs-emscripten library. It supports the browser (specifically tested with ESM.sh), as well as Cloudflare Workers, NodeJS, Deno: https://github.com/justjake/quickjs-emscripten?tab=readme-ov... It has APIs for exposing host functions, calling guest functions, custom module loaders, etc: https://github.com/justjake/quickjs-emscripten?tab=readme-ov... API docs for newFunction: https://github.com/justjake/quickjs-emscripten/blob/main/doc...

Hi, I’m the author of the underlying quickjs-emscripten runtime library. I like your ergonomic kind of “standard library” for quickjs-emscripten :) Did you try running in the browser or with a bundler? I think accepting the variant name as a string you pass to import(variantName) dynamically may not play well with Webpack et al. EDIT: SECURITY WARNING: this library exposes the ability for the guest (untrusted) code to `fetch` with the same cookies as the host `fetch` function. You must not run untrusted code if enabling `fetch`. Library should come with a big blinking warning about what is safe and unsafe to enable when running untrusted code. It’s not a “sandbox” if the sandboxed code can call arbitrary HTTP APIs authenticated as the host context! The reason quickjs-emscripten is low-level and avoids magic is so I can confidently claim