A safe eval library based on WebAssembly and Duktape/QuickJS.

Duktape Demo | Source code of Duktape Demo

In node:

const { duktapeEval, quickjsEval } = require('wasm-jseval')
duktapeEval.getInstance().then(mod => {
	console.log(mod.eval('1+1')) // 2
	const add = mod.newFunction(['a', 'b'], 'return a+b')
	console.log(add(1, 2)) // 3
})
quickjsEval.getInstance().then(mod => {
	console.log(mod.eval('1+1')) // 2
	const add = mod.newFunction(['a', 'b'], 'return a+b')
	console.log(add(1, 2)) // 3
})

In browser:

<script src="https://unpkg.com/wasm-jseval/duktapeEval.js"></script>
<!-- <script src="https://unpkg.com/wasm-jseval/quickjsEval.js"></script> -->
<script>
	// or quickjsEval
	duktapeEval.getInstance().then(mod => {
		console.log(mod.eval('1+1')) // 2
		const add = mod.newFunction(['a', 'b'], 'return a+b')
		console.log(add(1, 2)) // 3
	})
</script>

Returns a Promise to resolve the duktapeEval instance.

Returns a Promise to resolve the quickjsEval instance.

Evaluate JavaScript string in Duktape engine, and return a value.

Create a function like new Function to be called afterward.

duktapeEval can run ES5 syntax and some ES6, ES7 capabilities. quickjsEval can run almost complete feature set of ES10.

duktapeEval is smaller, but less feature. quickjsEval has a more complete JavaScript support, but it result in bigger size.

JSON.stringify is your friend. newFunction is a good choice too.

Just like normal eval, for example var a={};a.prop=1;a will return { prop: 1 }. But keep in mind, only JSON serializable data can be returned.

duktapeEval is about 348kB, and gzipped version is 154kB. quickjsEval is about 484kB, and gzipped version is 225kB.