Skip to content

Replace Rhino JS engine with QuickJS4J (WebAssembly-based)#1512

Draft
andreaTP wants to merge 1 commit into
alfio-event:mainfrom
andreaTP:quickjs-poc
Draft

Replace Rhino JS engine with QuickJS4J (WebAssembly-based)#1512
andreaTP wants to merge 1 commit into
alfio-event:mainfrom
andreaTP:quickjs-poc

Conversation

@andreaTP

Copy link
Copy Markdown

Replace Mozilla Rhino with QuickJS4J (QuickJS compiled to WebAssembly via Chicory), providing a naturally sandboxed JS execution environment without the need for custom AST validation or sandbox wrappers.

Key changes:

  • Add quickjs4j dependencies and annotation processor
  • Remove Rhino dependency and all sandbox infrastructure (SandboxContextFactory, SandboxWrapFactory, SandboxNativeJavaObject/List/Map, ScriptValidation, JSNodeVisitor, JSSymbol, JSErrorReporter, JSON)
  • Create annotated @builtins API classes (SimpleHttpClientApi, ExtensionUtilsApi, LogApi, ConsoleApi, ExtensionLoggerApi, InternalApi) for type-safe host bindings
  • Rewrite ScriptingExecutionService to use Engine/Runner with generated Builtins
  • Switch serialization from GSON to Jackson (Json.OBJECT_MAPPER) throughout
  • Add JS_PRELUDE shims for backward compatibility (HashMap, GSON, variadic wrappers for console/log/ExtensionUtils.format/computeHMAC)
  • Rewrite bundled mailchimp.js and sample.js for pure JS compatibility (no Java.type, no method calls on serialized objects)
  • Fix test scripts for QuickJS strict mode (var declarations, JSON.parse)

All 815 tests pass.

Replace Mozilla Rhino with QuickJS4J (QuickJS compiled to WebAssembly via
Chicory), providing a naturally sandboxed JS execution environment without
the need for custom AST validation or sandbox wrappers.

Key changes:
- Add quickjs4j dependencies and annotation processor
- Remove Rhino dependency and all sandbox infrastructure (SandboxContextFactory,
  SandboxWrapFactory, SandboxNativeJavaObject/List/Map, ScriptValidation,
  JSNodeVisitor, JSSymbol, JSErrorReporter, JSON)
- Create annotated @builtins API classes (SimpleHttpClientApi, ExtensionUtilsApi,
  LogApi, ConsoleApi, ExtensionLoggerApi, InternalApi) for type-safe host bindings
- Rewrite ScriptingExecutionService to use Engine/Runner with generated Builtins
- Switch serialization from GSON to Jackson (Json.OBJECT_MAPPER) throughout
- Add JS_PRELUDE shims for backward compatibility (HashMap, GSON, variadic
  wrappers for console/log/ExtensionUtils.format/computeHMAC)
- Rewrite bundled mailchimp.js and sample.js for pure JS compatibility
  (no Java.type, no method calls on serialized objects)
- Fix test scripts for QuickJS strict mode (var declarations, JSON.parse)

All 815 tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@codecov

codecov Bot commented Apr 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 51.63934% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.13%. Comparing base (1df2075) to head (e0e6a18).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...main/java/alfio/extension/SimpleHttpClientApi.java 7.89% 35 Missing ⚠️
...ava/alfio/extension/ScriptingExecutionService.java 82.00% 5 Missing and 4 partials ⚠️
...c/main/java/alfio/extension/ExtensionUtilsApi.java 33.33% 6 Missing ⚠️
src/main/java/alfio/extension/LogApi.java 42.85% 4 Missing ⚠️
.../main/java/alfio/extension/ExtensionLoggerApi.java 50.00% 3 Missing ⚠️
src/main/java/alfio/extension/ConsoleApi.java 80.00% 1 Missing ⚠️
...java/alfio/extension/SimpleHttpClientResponse.java 50.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main    #1512      +/-   ##
============================================
- Coverage     58.23%   58.13%   -0.10%     
+ Complexity     4579     4542      -37     
============================================
  Files           598      592       -6     
  Lines         23741    23630     -111     
  Branches       2122     2092      -30     
============================================
- Hits          13825    13738      -87     
+ Misses         8622     8602      -20     
+ Partials       1294     1290       -4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant