Reviving PyMiniRacer: A Python JavaScript Bridge
bpcreech.com
Reviving PyMiniRacer: A Python JavaScript Bridge
1–10 of 16 posts
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#2All the JSON that work with JavaScript, but not on Python. Finally a good solution?
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#3This looks very promising!
The problem I most want to solve with this kind of library is execution of untrusted user-provided code in a sandbox.
For that I need three things:
1. Total control over what APIs the user's code can call. I don't want their code being able to access the filesystem, or run subprocesses, or make network calls - not without me explicitly allowing a controlled subset of those things.
2. Memory limits. I need to be able to run code without fear that it will attempt to allocate all available memory on my computer - generally that means I want to be able to set e.g. a 128MB maximum on the amount it can use.
3. Time limits. I don't want someone to be able to paste "while true() {}" into my system and consume an entire CPU thread in an infinite loop. Usually I want to say something like "run this untrusted code and throw an error if it takes more than 1s to run"
My most recent favourite solution to this is the https://pypi.org/project/quickjs/ Python library wrapper around QuickJS, which offers those exact features that I want - memory limits, control over what the code can do, and a robust time limit.
(The one thing it's missing is good documentation, but the https://github.com/PetterS/quickjs/blob/master/test_quickjs.... test suite covers all of those features and is quite readable.)
Can PyMiniRacer handle those requirements as well?
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#4On a related note, Brython lets you run Python in the browser through JavaScript. You can even see Python in the HTML with “text/python” SCRIPT tags.
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#5There's also https://pyodide.org/en/stable/
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#6I'm always excited by the idea of rendering jsx from Python in the same process. Mostly as a bridge between eg. an existing Django app and full SPA React land. You'd swap out the scrappy Django string templating with jsx, then once a page passes some frontend interaction complexity threshold shift it over entirely (with shared components between both). Could this project help achieve this or are imports/build processes etc too much of an impediment?
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#7I'm always excited by the idea of rendering jsx from Python in the same process. Mostly as a bridge between eg. an existing Django app and full SPA React land. You'd swap out the scrappy Django string templating with jsx, then once a page passes some frontend interaction complexity threshold shift it over entirely (with shared components between both). Could this project help achieve this or are imports/build process…
I’ve often wondered about an automatic codemod that takes a Django template and turns it into an API endpoint + React component that does the same thing. Your {% if request.user.is_superuser %} checks get propagated to protecting the API data within. Frankly, though, the impetus to upgrade is often accompanied by a design rework anyways. But I do think it would be viable!
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#8This looks very promising! The problem I most want to solve with this kind of library is execution of untrusted user-provided code in a sandbox. For that I need three things: 1. Total control over what APIs the user's code can call. I don't want their code being able to access the filesystem, or run subprocesses, or make network calls - not without me explicitly allowing a controlled subset of those things. 2. Memory…
WASM meets those requirements. Basically its proposition. The only thing would be whether a higher-level language you want would compile to it.
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#9This looks very promising! The problem I most want to solve with this kind of library is execution of untrusted user-provided code in a sandbox. For that I need three things: 1. Total control over what APIs the user's code can call. I don't want their code being able to access the filesystem, or run subprocesses, or make network calls - not without me explicitly allowing a controlled subset of those things. 2. Memory…
WASM meets those requirements. Basically its proposition. The only thing would be whether a higher-level language you want would compile to it.
Yeah, I've been hoping to get good results from this out of WASM for ages. My latest attempt was this one: https://til.simonwillison.net/webassembly/python-in-a-wasm-s...
It's still not quite as easy as I want it to be!
Re: Reviving PyMiniRacer: A Python <> JavaScript Bridge
#10This looks very promising! The problem I most want to solve with this kind of library is execution of untrusted user-provided code in a sandbox. For that I need three things: 1. Total control over what APIs the user's code can call. I don't want their code being able to access the filesystem, or run subprocesses, or make network calls - not without me explicitly allowing a controlled subset of those things. 2. Memory…
... and I just spotted this here: https://bpcreech.com/PyMiniRacer/api/#py_mini_racer.py_mini_...
call(expr, *args, encoder=None, timeout=None, max_memory=None)