hetunandu

Is the concern with running JS on the client side regarding security? At Appsmith we run user code inside a worker to avoid malicious code from accessing many browser apis. We also plan to add the ability to run the JS code on the server and have it run via web hooks for automation use cases. I wrote how we do it at Appsmith a few months back:

https://blog.appsmith.com/evaluating-js-in-the-browser-for-a...

Nice article. It was one of the inspirations of the first version of the evaluation workflow. We actually have eval running in global context always with just a select items being injected inside eval to ensure security. Also this happens inside a web worker so the scope of global actions a malicious script can take reduces drastically

Author here. We have experimented with Realms in the past and had a working version for some time. Also did some POC with quickjs. In both scenarios, we saw performance degrade a lot.. So our current eval is run actually in the web worker so we take extra precautions to avoid leaking any problem some browser api inside the eval context. I like the idea of having a wasm eval environment as well, will experiment with that soon. Thanks for the tips :)