In-browser visualizer workshop/playground

[gwhitney]

This discussion is a placeholder for the fact (raised, for example, in #46) that we would ultimately/ideally like to be able to code new visualizers right in the browser UI, like a jsfiddle/codepen type of thing. This discussion can also encompass ideas on how we might engineer that.

[gwhitney]

This and the next two comments are copied from #85, which was an issue for the exact same thing, which I am closing because we don't have a plausible implementation plan for this in the moderate future.

Determine if it is possible or feasible for visualizers to be created by others without needing to be specifically included in this repo.

Note that this would probably require something like enabling people to run arbitrary js in the app, which has security implications. An alternative is a sandboxed subset of JS, which, given that we mainly use drawing libraries like p5, may not be impossible, but would probably be a large project.

[gwhitney]

at our year-end meeting the discussion included how it would be nice to have an instant visualizer feature like the p5 editor (https://editor.p5js.org/) in the Numberscope. So this will be the issue recording the desire for such a feature.

I don't know how bad the security implications are, since it seems as though the code would run just in the client's browser -- as long as it doesn't inherit any ability to modify anything in the backend. So naively (and I know almost nothing about web security) it seems like "malicious" visualizers could trash the client's computer but not Numberscope itself. But there may be a class of JavaScript exploits that I'm just not familiar with that pose a threat to Numberscope.

[gwhitney]

Here's a StackExchange post that talks about some security risks and how to deal with them, for sites like jsFiddle (which provides instant in-browser JavaScript execution). But note one of the comments in that post makes a distinction between users only running their own code (which would be our case) vs. users running each others' code (which was the poster's case, and which is presumably more fraught with risks). Since there seem to be ways of doing even the latter, we can presumably figure out how safely to do the former. It would be nice to find a similar post (or we could ask on StackExchange ourselves) about best practices for allowing users to run their own customized JavaScript code.

Anyhow, the link: https://stackoverflow.com/questions/21218857/security-issues-for-allowing-users-to-add-own-javascript-to-your-site