What does HackerNews think of quickjs-emscripten?
Javascript/Typescript bindings for QuickJS, a modern Javascript interpreter written in C by Fabrice Bellard.
Curious if people have seen any other routes to doing it via WASM.
I maintain a library for using QuickJS, a JS interpreter with more modern language support, from NodeJS or the web called QuickJS-Emscripten: https://github.com/justjake/quickjs-emscripten
This was inspired by seeing Duktape WASM build on HN (https://github.com/maple3142/duktape-eval) and Figma's blogposts about building a Javascript plugin runtime:
- How Figma built the Figma plugin system: Describes the LowLevelJavascriptVm interface (https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...)
- An update on plugin security: Figma switches to QuickJS (https://www.figma.com/blog/an-update-on-plugin-security/)
One problem is that it’s very difficult for an app to run arbitrary, untrusted user code in a way that’s secure and efficient, especially in the browser. Apps need to worry about XSS and unintended remote code execution, much less try adding those things as a feature.
I started working on a Typescript/WebAssembly library around the QuickJS JavaScript runtime to address this need. QuickJS runs modern ES2020 and provides an API for the host process to set CPU and memory budgets for the execution environment, which is completely sandboxed. My work so far exposes a basic interface to create VMs, expose APIs from the host to the guest, and evaluate code.
Repo: https://github.com/justjake/quickjs-emscripten
NPM: https://www.npmjs.com/package/quickjs-emscripten
Areas of work:
- Make the library importable as ES modules on the web without a Webpack build step.
- Design higher-level but still security-conscious APIs for building plugin systems on top of the existing library.
- Expose more QuickJS C APIs to library users.
- Performance or ergonomic improvements.
If you share any of these goals or would like to help out, please drop me a line on GitHub (eg by opening an issue), or via any of the links on my HN profile.
We’ve found quickjs-emscripten [2] to work really well thus far. You can see my implementation of it here [3] in Lowdefy. If still has a few rough edges, so would be really keen to make it better.
I’m interested to know, is spidermonkey more comparable to V8 than QuickJs?
[0] - https://www.figma.com/blog/how-we-built-the-figma-plugin-sys... [1] - https://bellard.org/quickjs/bench.html [2] - https://github.com/justjake/quickjs-emscripten [3] - https://github.com/lowdefy/lowdefy/blob/main/packages/operat...
I'm also building a workflow engine on the side, but don't want to see you run into security issues :)
Look into the realms TC39 proposal, the SES TC39 proposal, or running (no joke) a lightweight ES6 environment in webassembly to eval your code.
https://github.com/tc39/proposal-realms/#ecmascript-spec-pro...