Idea: Webview Component Customization

[parker-codes]

Heyo! 👋🏼 From what I've heard and read, Servo aims to be modular in design. I had an idea to meet my team's security and performance needs, while perhaps fitting well into this modular design.

Is it possible to make certain components of the webview optional? If possible, the benefits could be reduced size, memory usage, and attack surface area. Tauri does this.

For example, if we wanted to create an instance of a webview that could only render HTML and CSS but exclude JS to keep things super slim and more secure, is that possible? Events may be able to be triggered some other way. I'm thinking about use cases in tangential UI and even embedded devices too. Other components could be WebGL, Canvas, networking, etc.

[wusyong]

Tauri adds another layer to check those configurations. Servo has prefs.json to edit these but it's global.
There's a similar topic in zulip, but I was talking about the opposite which is expand some features like custom IPC.
I think this is a meta issue which require more discussion to figure out which specific implementation we can add to servo.
The first one I could come up with is the restricted JS access you mentioned.
Perhaps there could be a web context with limited web API to use.