Questions about the beautifier and why it is needed

[MrLi2018]

Evaluating the beautifier.js file is time-consuming. Can it be deleted or closed? What problems does it solve?
scriptEngine.eval(getBeautifyJs()); It takes a long time. Can you set the switch to disable it?

[mxro]

Thank you for your question @MrLi2018 !

The beautifier is used to make it easier for the subsequent steps to inject the statements that check if the process needs to be interrupted. I guess if we would construct an AST of the JS and then compile it into JS again, we could maybe omit this. Or maybe through some more clever regexes - but for the time being, the injections won't work without it.

[MrLi2018]

What do you mean by injection? Beautifier is only used to format JS. If JS is not required in the program, can it be deleted? Or is it having other security concerns? @mxro @tangrammer @turbanoff @obourgain

[obourgain]

Hello, I am not a maintainer, so can only speak about my understanding of the code.

The beautifier is used to format the script in this method, and then once it is properly formatted, it will inject some code in some parts of the script here for the list

The interruption flag is used to make a script exit, for example if it went over its allocated cpu time.

I don't understand what you mean by If JS is not required in the program? I think the purpose of delight-nashorn-sandbox is to run JS.

For my project we did two changes to reduce the cost of the beautifier:

• use a single instance of JsSanitizer, but please be aware that it is not thread safe
• create and cache the sandbox for each script, so we only pay for the beautification and injection of interruption once

[MrLi2018]

Thank you for answering the question. However, during program debugging, I found that I only used this code.（final String preamble = getPreamble();return preamble + injectedJs;） Therefore, I wanted to ask whether to remove jsbeautiful in certain scenarios because it was time-consuming, and I tried to rewrite the JsSanitizer class and remove jsbeautiful only to use splicing, and ut passed, so I don't understand if it's necessary, in some scenarios. @obourgain

[obourgain]

in NashornSandboxImpl you can override method protected JsSanitizer getSanitizer() to provide your version of JsSanitizer.