DOOM (for real)

This is the actual Chocolate Doom engine, compiled to WebAssembly, executing in your browser inside this paragraph's neighbour.

<script src="/sandbox/libs/doom.js"></script>

That code block above is the entire thing. It is an ordinary ```html fence, the same kind you would use for a chart or a diagram. There is no special doom fence and no magic block type, which is the whole point: you can select that line, paste it into a document of your own, and get the same result.

Doom was a good stress test precisely because it needs more than a diagram does. It compiles WebAssembly, and it fetches its own engine binary and game data at runtime. Both of those had to be granted without opening a hole, and both are covered by adversarial tests rather than by assertion.

One example of the difference that makes. A Content Security Policy matches on the path of a URL and ignores the query string, so a block could have written:

fetch('/sandbox/libs/doom.wasm?secret=' + document.title)

CSP would have permitted that request, and the reader's data would have left the page inside a URL. The preview frame refuses it before the request exists, which is a thing you only find by trying it.

ight into the first level on a harder skill:

Credits

The engine is Chocolate Doom compiled to WebAssembly, GPL-2.0-or-later, and the complete corresponding source is published at github.com/strata-space/doom-wasm. The game data is Freedoom, a BSD-licensed replacement IWAD, so no commercial Doom data is involved. Freedoom is the work of a lot of people who rebuilt an entire game's worth of art and levels from scratch, and it deserves the credit.