I'm creating a service for creating web tools. The tool is a generated web page with some JS engine. The user can interact with the JS engine through the user interface. The user interface can be either ready-made or custom.
The idea of using a custom user interface is dangerous. This approach creates possible security issues (eg XSS).
Please advise a more efficient solution for the implementation of the HTML playground.