In terms of an application that's about affording its end-uses the ability to add, view, and manipulate their own data (like Podio, Trello, Redbooth, Asana, et cetera), I'm wondering how it can be designed such that it also affords them the ability to add code-as-data to the app and have the app be a function of that user-added-code as well as its original, base code.

I wonder, in particular, how to do this with a web app; so, in a JavaScript context. I've seen a number of assertions that eval() is "evil", but I can't think of any other way to take code from a user. And, even with eval(), it's unclear to me how to how to structure the app such that it can incorporate that user-supplied code back into itself. Additionally, should there be a core of the app that's never changed to keep the user from nuking the system —TiddlyWiki (something that seems to exemplify the quality I've in mind) mentions a "microkernel", a "boot script", and module system, though I don't quite get how it all works.

From what I've looked at thus far, I've seen mention of DSLs a lot. How's that fit in? And some stuff about vulnerability to malicious injection and the need to sandbox (or something) the user code. How's that work?

Spreadsheet apps also come to mind as doing what I'm asking about. With many of 'em, one can write their own functions that tie into core parts of the app and that stuff is written in cells as data.

closed as too broad by Robert Harvey Aug 6 at 15:36

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    It is unclear to me how all of this relates to homoiconicity. Can you explain that in a little more detail? In particular, you talk about JavaScript, which is not homoiconic. – Jörg W Mittag Feb 7 at 7:49

I think I can see why this question is getting little response. I myself considered voting to close as too broad or unclear.

First I had to look up the fancy word. Than it occurred to me that in a web context this whole approach makes little sense, it is pointless. This is why it does not exist, why you had a hard time finding examples and why readers of you question shrug.

Web applications are services, not programming tools. Imagine you have a problem with your car and you bring it in for service. There is a guy who, after hearing you out, tells you where the tools are and wishes you good luck, then goes for lunch.

This kind of business does not exist for obvious reasons. Well, it does in a way, but it is called a rental service. You bring the tools home and use them. That is like installing something on your desktop computer and code away. There is no online component here that adds value.


Adding code as data and adding text as code and calling eval on it are two different things. Calling eval directly on text is a no-no because it opens your program to be susceptible to injection attacks.

However, it is possible to protect your code using a sandbox library such as YUI3 so that your framework code remains in tact and cannot be overridden. I would strongly recommend that you use a library for this, as it probably isn't something you want to mess up, in the interests of your program integrity. However, all a sandbox is essentially doing is putting your functions into a higher scope so they cannot be overridden or even called without being a call directly coming from the very same sandbox (so your own code).

It would also probably be in your best interests to use a sandbox to run code added by the user as well. If you want to be more sophisticated still, there are libraries like Esprima which can also tell you if the code is valid code before you attempt to make it available to run. This isn't for security measures so much as simply preventing your browser from attempting to run code which is broken.

So in conclusion: eval is evil. Sandboxing is less evil.

Not the answer you're looking for? Browse other questions tagged or ask your own question.