News for hackers. Stuff that matters.

A comment on Evaluating JavaScript in the browser for a low code product. Parent comment

Re:Evaluating JavaScript in the browser for a low code product by flowerlad on Tuesday January 26, 2021 @11:34AM (#25917792)
> you don't want to be throwing `eval` in your code

Unless you have generated the JS code yourself, in which case it is safe.

What kind of perf are you getting with QuickJS? If you have to evaluate an expression 10,000 times is QuickJS at least half as quick as eval?

[ Parent | on HN ]
Re:Evaluating JavaScript in the browser for a low code product by tonyhb on Tuesday January 26, 2021 @12:03PM (#25918239)
True. Though I'd err on the side of caution in case someone in the team makes a PR to enable templating or user data somewhere that uses this code under the hood. Currently working in healthcare, so it's safest to work under the assumption of "don't introduce anything unsafe if possible, even if we know data is sanitized by us". Just in case one day that data is _not_ supplied by us.

RE. perf, I initially used Realms and it was fine. Right now I'm using wasm for templating and cuelang parsing - the speed is _good enough_ for the current UI, though I haven't really done strict performance testing yet, being honest :(

[ Parent | on HN ]