JSFiddle - React, Tailwind, and code Playground

by jongobar

HTML

<pre id="out"></pre>

JavaScript

function buildQuarantinedEval(){
	var empty=(function(){
		var exceptionKeys = [
				"eval", "Object",
				"Number", "String", "Boolean", "RegExp",
                "JSON", "Date", "Array", "Math",
				//"this",
				"parseInt","parseFloat",
				"strEval"
		];
		var forbiddenKeys=["window","self"];
		var forbidden=Object.create(null);
		[window,this,self].forEach(function(obj){
			Object.getOwnPropertyNames(obj).forEach(function(key){
				forbidden[key]=null;
			});
			Object.keys(obj).forEach(function(key){
				forbidden[key]=null;					
			});
			for(var key in obj){
				forbidden[key]=null;
			}
		});
		forbiddenKeys.forEach(function(key){
			forbidden[key]=null;
		});
		exceptionKeys.forEach(function(key){
			delete forbidden[key];
		});
		Object.freeze(forbidden);
		var empty=Object.create(forbidden);
		Object.freeze(empty);
		return empty;
	})();
	return function(strEval){
		return (function(empty,strEval){
			try{
				with(empty){
					"use strict;"
					return eval(strEval);
				}				
			}
			catch(err){
				return "(error) "+err.message;
			}
		}).call(empty,empty,strEval);
	};
}

var qeval=buildQuarantinedEval();
qeval("'some expression'");		//evaluate
	
var testBattery=[
    "var arr=[1,2,3,4,5]; arr[Math.floor(Math.random()*arr.length)];",
	"'abc'",
	"8*8",
	"console",
	"window",
	"location",
	"XMLHttpRequest",
	"self",
	"window===null",
	"location.href",
	"eval('1+1+1')",
	"eval('7/9+1')",
    "Date.now()",
    "document",
	"/^http:/",	    
    "JSON.stringify({a:0,b:1,c:2})",
    "HTMLElement","typeof(window)",
    "Object.keys(window)",
    "Object.getOwnPropertyNames(window)",
	"var result; try{result=window.location.href;}catch(err){result=err.message;}; result;",
	"parseInt('z')","Math.random()",
	"[1,2,3,4,8].reduce(function(p,c){return p+c;},0);",
	"this.prototype=null;delete this.prototype; window.location;",
	"this['ale'+'rt']",
    "Object.keys(this).filter(function(k){return !!this[k];}).length;",
	"eval('window')",
	"var x=0xff00ff00; var...