JavaScript eval() on client-side for running untrusted code -

i have been reviewing threads can find on security implications of using eval() on client-side of javascript webpage.

i implementing site should allow user run own code (written on page) , see visual results on div on same page.

essentially, want user able write valid javascript code, , have manipulate canvas on same page.

there no need server-side evaluation of code.

i have had @ both jailed , caja, think may adding additional complexity not required.

i understand right way of doing type of thing in "sandbox" has no access rest of codebase, however, needs such cannot define simple api provide safe entry/exit points...i want user able use javascript code , dont want have write interpreter provide api.

given there no server-side evaluation required, , there should ever single user executing own code in web session, safe use eval()?

if have no path in logic allows 1 person publish code used others can use eval() is.

your situation not anyhow different user has browser , dev tools in he/she can run code want.