I would definitely disable:
- Posting Stack Snippets for users with < X rep (tresholdthreshold at staff's discretion)
- Running Stack Snippets for anonymous users
- Running Stack Snippets for users that did not previously opt-in for them
Alternate to 1: enabling a Stack Snippet only after peer review by users with review privileges (e.g. I can review on SO, but not on SU)
Preventing run for anonymous users is simply a way to protect the most inexperienced.
Finally no matter the sandbox I would pay great attention to user-posted code. After tons of articles about do not trust user input
([1] [2] and a lot more) how dare you allow people to run Javascript on another person's computer with the press of a button? Kidding...
I don't think that working on a heuristic Javascript scanner (eval
is first candidate to evilness) to block script is a good idea. We don't need a Javascript antivirus :-)