Q394: Safe Code Execution Drill Timeouts Sandboxing and Console Capture

What Interviewers Want To Evaluate

This drill tests whether you understand the risks of running user-written code in a frontend tool.

Even a local learning sandbox can freeze the page, leak data, or create confusing output if execution is not bounded.

The interviewer wants to see safety thinking without overengineering the first version.

Short Interview Answer

For safe code execution, I would run snippets in a constrained environment, capture console methods explicitly, set execution timeouts, isolate each run, and avoid exposing secrets or privileged APIs. For a learning tool, the first version can be pragmatic, but it still needs loop protection, error capture, and clear reset behavior.

Risk Inventory

Risks include:

infinite loops
huge console output
mutating global state
accessing localStorage unexpectedly
network requests
long async tasks
uncaught errors
browser tab freeze

You do not need perfect isolation to start.

You do need to know what can go wrong.

Execution Isolation

Options:

same-window evaluation
iframe sandbox
Web Worker
server-side sandbox

For a frontend learning tool, a Web Worker or sandboxed iframe is often safer than same-window evaluation.

Same-window evaluation is easiest but has the most risk.

Console Capture

Capture:

console.log
console.info
console.warn
console.error
thrown errors
unhandled rejections

Store output as structured entries.

That makes rendering, copying, filtering, and clearing easier.

Timeout Strategy

Timeouts should handle:

long-running synchronous work
long-running async work
too many logs
large output objects

A timeout message should explain what happened:

Execution stopped after 2 seconds.
Check for an infinite loop or long-running operation.

This helps learners debug.

Reset Per Run

Each run should start clean:

clear previous execution state if requested
create new run id
capture fresh console entries
stop previous run if still active
show current status

Run IDs help prevent stale output from appearing after a later run.

Security Boundary

Avoid exposing:

environment variables
auth tokens
private app state
internal APIs
admin endpoints

Frontend code already ships to the browser, but the sandbox should not make sensitive data easier to reach.

UX Behavior

Show:

running
completed
failed
timed out
stopped

Allow:

run
stop
clear
copy
reset

The learner should know whether the code is still running.

Testing Plan

Test:

normal logs
thrown error
promise rejection
infinite loop timeout
large output limit
multiple runs do not mix output
stop action works
copy output works

Safety features need tests because regressions are easy to miss manually.

Common Mistakes

• Using eval directly without boundaries.
• Letting infinite loops freeze the whole app.
• Not capturing console.error.
• Mixing output from multiple runs.
• Exposing app secrets to snippets.
• Not limiting output size.
• Hiding timeout reason.

Final Mental Model

Safe execution is:

isolate
capture
limit
reset
explain
recover

A practice ground should invite experimentation without punishing mistakes.