sandbox.html

<!DOCTYPE html>
<html lang="en">
<head>
    <title>Sandbox</title>
</head>
<body>
<script>
    const originalConsoleLog = console.log;
    console.log = function(...args) {
        window.parent.postMessage({ type: 'log', args: Array.from(args) }, window.location.origin);
        originalConsoleLog.apply(console, args); // Keeps log in iframe console
    };
    async function asyncEval(code) {
        return new Promise((resolve, reject) => {
            try {
                const result = eval(code);
                resolve(result);
            } catch (error) {
                reject(error);
            }
        });
    }

    window.onmessage = async (event) => {
        if (event.origin === window.location.origin) {
            try {
                const result = await asyncEval(event.data.code);
                window.parent.postMessage(result, window.location.origin);
            } catch (error) {
                window.parent.postMessage({ error: error.message }, window.location.origin);
            }
        } else {
            console.error('Message received from untrusted source:', event.origin);
        }
    };
</script>
</body>
</html>