Typing "while(1){}" then clicking "Run" hangs the browser about interactive-examples

[schalkneethling]

Implement[or use] a library that will sanitise the live code before executing it. Perhaps worth looking at existing editors such as CodePen and jsFiddle to determine if there are existing solutions before rolling our own.

[wbamberg]

Codepen does this by running the example for a few seconds, then killing it if it is still running. For example, if you just write a pen like this:

for (let i = 0; i < 100000; i++) {
  console.log("blah")
}

... you'll get the "infinite loop" error, and in the console a more nuanced message:

"[CodePen]: An infinite loop (or a loop taking too long) was detected, so we stopped its execution. Sorry!"

I guess to do this we would run it in a worker. Do you think this might also make us a bit happier about using eval, since the code wouldn't get access to the iframe's DOM?

[wbamberg]

Adding release blocker label for the security question: is it acceptable for the editor to eval() user-entered JS, and if not which safer alternatives should we implement?

[schalkneethling]

Is this still a release blocker now that we are no longer using eval?

[wbamberg]

No :). If using Function addresses the security problems of eval, then this doesn't need to block.

[schalkneethling]

@wbamberg After having learned how codepen handles this, and that jsFiddle does not do anything to prevent users from running code like this, what do you say:

1. Keep it in the backlog as a nice to have, maybe, possibly, some day based on user feedback or,
2. Let's close this out and not worry about it.

Thanks!

[schalkneethling]

I am going to close this out. We can revisit in future should the need arise or a simple solution is found.