dukpy VS PyMiniRacer

oh good, maybe we can now use python's javascript interpreter in browsers https://github.com/amol-/dukpy

I was interested to see that this uses the DukPy wrapper around Duktape for the JavaScript interpreter: https://browser.engineering/scripts.html

This made me start digging into whether this was considered a "safe" way of executing untrusted JavaScript in a sandbox.

its not completely clear to me if DukPy currently attempts safe evaluation - it's missing options for setting time or memory limits on executed code for example: https://github.com/amol-/dukpy

There's a QuickJS Python wrapper here which offers those limits: https://github.com/PetterS/quickjs

I'm pretty paranoid though any time it comes to security and dependencies written in C, so I'd love to see a Python wrapper around a JavaScript engine that has safe sandbox execution as a key goal plus an extensive track record to back it up!

I didn't write it, but here you go. Thanks to the fact that you can pass Python arguments to the JavaScript function, it will nicely cast them for you (via JSON) and make them behave per a Javascript object, which can then do some funsies to make it act like a string.

Embedding V8 can work quite well: https://github.com/sqreen/PyMiniRacer

You probably have to emulate some of the DOM, but you can interact directly with whatever obfuscated/packed scripts in a more lightweight and secure way than driving an entire browser.

First learn what forms computer code can be in. Source code combine js and python or to combine c and C++ object code with a linker or at runtime if you want to shell out and run from the prompt

If you want battle-hardened, I figure you can't do better than V8. Here's a Python wrapper that I've poked at a bit (it's not quite 100% feature-complete but it seems to essentially work): https://github.com/sqreen/PyMiniRacer