Use case - Script sandboxing for 3rd party tools

[xaviergonz]

I just read this line in the slide https://ptomato.name/talks/tc39-2025-02/#5
"If you have a use case, please come talk to me!"

A use case is creating a sandbox for user/3rd party scripts. I know it is actually in the docs, but I wanted to document an actual use case where it was considered.

Figma had to resort to running their own JS interpreter in WASM to achieve that sandboxing because the realms shim was not up to the task (it could be escaped):

https://www.figma.com/blog/how-we-built-the-figma-plugin-system/#attempt-3-realms

[ptomato]

Thanks. This is very helpful, especially the blog post. I'm gradually building up a dossier of use cases and will include this.

To check my understanding, would you say that the Realms shim did not fit your use case because it couldn't be faithfully and securely implemented without real browser support, and if ShadowRealm was implemented in browsers you'd be able to use that instead of WASM-embedded Duktape? Or would the audit surface still be too large even with real ShadowRealms?