问题 Imagine a scenario where I want to continuously invoke user-supplied Javascript code, like in the following example, where getUserResult is a function that some user (not myself) has written: for (var i = 0; i < N; ++i) { var x = getUserResult(currentState); updateState(currentState, x); } How can I execute that kind of code in a browser and/or Node.js, without any security risks? More generally, how can I execute a Javascript function that is not allowed to modify or even read the current