Running QuickJS via WebAssembly

Executing untrusted JavaScript paradigms generally requires a rigid server-side container orchestration system to prevent host compromise. A more secure, minimal-latency approach leverages a client-side WebAssembly (WASM) build of the QuickJS engine. This compiles an entirely independent JavaScript runtime directly within the user's browser thread, guaranteeing complete isolation from the native DOM context.

This implementation utilizes the `quickjs-emscripten` library to instantiate the isolated execution context. Native functions, such as console.log() and a synchronous `fetch` equivalent, are explicitly bound into the WASM instance prior to evaluation. Code inputted into the user interface is securely executed using vm.evalCodeAsync() [1].

A browser window showcasing a JavaScript code editor and the output generated by the WebAssembly runtime
Figure 1: The QuickJS sandbox environment compiling and executing JavaScript natively.

To improve usability, state retention is achieved by pushing the raw, URI-encoded script directly to the URL hash fragment. Execution interrupts are seamlessly managed through keyboard shortcuts, mapping Ctrl + Enter to the evaluation subroutine [2].

Analyzing the required WASM bundle 
$ curl -s https://cdn.jsdelivr.net/npm/quickjs-emscripten@0.31.0/dist/index.global.js | head -n 5

References

  1. Willison, S. "QuickJS Code Executor". Available: https://tools.simonwillison.net/quickjs.
  2. Willison, S. "quickjs.html Source Code". Available: https://github.com/simonw/tools/blob/main/quickjs.html.