Re:Evaluating JavaScript in the browser for a low code product
by hetunandu on Tuesday January 26, 2021 @01:52PM
(#25919694)
Nice article. It was one of the inspirations of the first version of the evaluation workflow. We actually have eval running in global context always with just a select items being injected inside eval to ensure security. Also this happens inside a web worker so the scope of global actions a malicious script can take reduces drastically
This reminded me to a series of posts by Figma in which they described how their JS plugin system works [1].
I remember there were plenty of security reasons why eval was not the best way to go. I wonder if you guys took this into account?
[1] https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...