InsideReCaptcha VS quickjs

Google: implements an entire obfuscated VM with its own bytecode inside Javascript for their CAPTCHAs so that people cannot cheat it

While they likely wouldn't do a zero-day, their JS files, particularly for automated captchas, do push the boundaries of whatever JS engine they're executed inside. See https://github.com/neuroradiology/InsideReCaptcha#the-analys... and note that this analysis is 8 years old. While there's minimal risk if you're either using a full-fledged modern JS engine or a limited-subset interpreter like the OP, an older or non-optimized spec-compliant JS engine might hit pathological performance cases and result in you DOSing yourself.

So people voting for DCR are not allowed to protect their privacy with VPNs, must reveal their real IP address, and must allow proprietary, obfuscated, sophisticated Google reCAPTCHA to fingerprint the heck out of their devices.

You can use it as en embedded scripting language within Python.

[1] https://github.com/PetterS/quickjs

You could run the webextention javascript in quickjs.

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html

This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox.

its not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for example: https://github.com/amol-/dukpy

There's a QuickJS Python wrapper here which offers those limits: https://github.com/PetterS/quickjs

I'm pretty paranoid though any time it comes to security and dependencies written in C, so I'd love to see a Python wrapper around a JavaScript engine that has safe sandbox execution as a key goal plus an extensive track record to back it up!