About this copy of JSLogo

This is a copy of JSLogo, a Logo interpreter that runs in the browser, written by Joshua Bell (inexorabletash). It is kept on this site so that students can try real Logo without leaving it, and so that nothing a student types ever goes to another website. Back to JSLogo or to TurtleLab.

• Original: github.com/inexorabletash/jslogo (live at calormen.com/jslogo).
• Copied from: commit 26dfcac41daa4477182ce7c1a00acbd913ab5fd5, 2 October 2026.
• License: Apache License, Version 2.0, the same as the original. The full text is in LICENSE.md and every JavaScript file keeps its own notice. Copyright is Joshua Bell's. CodeMirror (in vendor/codemirror/) is MIT licensed, Copyright (C) Marijn Haverbeke and others; its license is vendor/codemirror/LICENSE.
• This is not the original and is not made, endorsed or supported by its author. If something is broken here, it may be our change. The original is the place for bug reports about Logo itself.

What we changed, and why

The changes are all about privacy: the page must not contact any other site, and must not keep anything on the student's computer. The interpreter itself (logo.js), the turtle (turtle.js) and the editor are as they were, apart from the small fixes at the end.

1. No outside requests. The original loaded CodeMirror (the editor) from cdnjs.cloudflare.com, a font from fonts.googleapis.com, and TogetherJS (a real-time collaboration service) from togetherjs.com. Here, CodeMirror 5.61.1 is a file in vendor/codemirror/, the font is left out (the heading uses the browser's own), and TogetherJS and its Collaborate link are removed, along with the code that talked to it.
2. A policy that enforces it. index.html and language.html carry a Content-Security-Policy that lets the page load only from itself (default-src 'self', no inline scripts, no eval, no form posts). If anything ever tried to reach another site, the browser would refuse. To make that possible, the one inline script in language.html became the file language.js.
3. Nothing is kept in the browser. The original saved your procedures and your history in the browser's IndexedDB and loaded them again on every visit. That is removed (initStorage in index.js does nothing), so the Library and History lists last for one visit and a refresh starts fresh.
4. Left out to keep the copy small: the test page and tests (tests.html, tests.js), 15word.html and the contributor files. The language files are kept.
5. Small fixes:
   • A program in the address (for example /logo/#fd 100 rt 90) that has several lines now opens in the big editor box, so it can be read.
   • A message sent to the page with postMessage is only accepted from this site, and the reference page only sends to this site.
   • Two links in the top bar changed: one back to TurtleLab, and one to this page.
   • to_arity in logo.js no longer uses eval (it built a function from a string that included the procedure's name). It does the same job without one. That is what lets the policy above forbid eval, which Logo procedures (to ... end) would otherwise need, and it closes a way a strangely named procedure could inject code.

Sending code here from TurtleLab

TurtleLab's Logo box has an Open in real Logo button. It opens this page with the program in the part of the address after the #, which never leaves the browser, and the program runs at once. TurtleLab's own Logo has a few differences from this one, so the button writes the program again for this interpreter: colors become CSS color words, arcs become short straight steps, a clean puts the pen back the way TurtleLab leaves it, fills use filled, and anything that has no equivalent (such as the speed block) is left out, with a comment that says so. Underscores in an address are read as spaces here, so the button writes them as %5F.