I need to eval() the code inside my page because I am working on something jsFiddle-like. Since eval has such a bad reputation, how can I interpret the user input code safely and securely? Or as safely and securely as possible?
I would suggest you have a look at the following resources:
- https://code.google.com/p/jsreg/
- https://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes
- http://www.thespanner.co.uk/2012/10/18/mentaljs-sandboxparser/
Anyway, you should consider running the code that's coming from untrusted users/sources on another domain than where your main site/content is located.
来源：https://stackoverflow.com/questions/21408343/how-to-run-javascript-inside-browser-safely-and-securely