title: How to safely run user-supplied Javascript code inside the browser?
body: <p>Imagine a scenario where I want to continuously invoke user-supplied Javascript code, like in the following example, where <code>getUserResult</code> is a function that some user (not myself) has written:</p>
  
  <pre><code>for (var i = 0; i &lt; N; ++i) {
      var x = getUserResult(currentState);
      updateState(currentState, x);
  }
  </code></pre>
  
  <p>How can I execute that kind of code in a browser and/or Node.js, without any security risks?</p>
  
  <p>More generally, how can I execute a Javascript function that is not allowed to modify or even read the current webpage or any other global state? Is there something like an in-browser "JS virtual machine"?</p>
  
  <p>How does JSFiddle ensure that you cannot run any malicious code (at the very least it could phish your login name, run a bot for the lifetime of the page, if not do much worse things)? Or doesn't it ensure that at all?</p>