如何安全地运行/包含/需要远程 javascript？

Question

Suppose I have an API for my bakery. I want to receive my baking instructions from a remote URL (ex: a gist)

class Bakery{
    static bake(instructionsURL){
        const workers = ['bob','betty'];
        //const followInstructions = getFromURL(instructionsURL); //need help here
        const product = followInstructions(workers);
        console.log(product);
    }
}

I'd like to make sure the instructions are contained so that I don't risk the rest of my code. I would like to do something like a module require or import. I can't find a solution where I don't have to blindly execute unknown code...

Answer 1

You should execute the code in a sandboxed iframe on an external domain, exactly like what StackOverflow does to handle running untrusted code in its snippets feature.

Do note that very old browsers (think before IE11) do not support sandboxed iframes.