Nice article. It was one of the inspirations of the first version of the evaluation workflow. We actually have eval running in global context always with just a select items being injected inside eval to ensure security. Also this happens inside a web worker so the scope of global actions a malicious script can take reduces drastically
Comments
Nice work!
This reminded me to a series of posts by Figma in which they described how their JS plugin system works [1].
I remember there were plenty of security reasons why eval was not the best way to go. I wonder if you guys took this into account?
[1] https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...
Nice article. It was one of the inspirations of the first version of the evaluation workflow. We actually have eval running in global context always with just a select items being injected inside eval to ensure security. Also this happens inside a web worker so the scope of global actions a malicious script can take reduces drastically