Online3DViewer - Moses Yebei

The Problem

Browsers cannot natively open CAD, mesh, or BIM files like STEP, IFC, or GLTF. Teams evaluating or sharing 3D models must install desktop software, convert files, or rely on proprietary viewers. Online3DViewer removes that friction by rendering 18 import formats directly in the browser with no server-side processing.

What This Does

Online3DViewer is a JavaScript library and web application for viewing, measuring, and exporting 3D models. The source/engine/ directory contains the core library: geometry math (coord3d.js, matrix.js, octree.js), import/export handlers (importer.js, exporter.js), and a viewer built on three.js. The source/website/ directory wraps that engine in a full UI with settings, localization, and file management.

The repo also ships sandbox/ with 30+ self-contained HTML examples showing embedding patterns, and docs/ with generated API reference pages. It is a fork of the actively maintained kovacsv/Online3DViewer (3,663 stars), so the codebase is mature despite this fork's zero stars.

How It Is Wired

Execution starts in source/engine/main.js, which has 31 modules importing it and 77 imports of its own (instability 0.71). It routes through source/engine/import/importer.js for file parsing and source/engine/export/exporter.js for serialization. The geometry layer is the stability anchor: source/engine/geometry/geometry.js has 33 dependents and imports nothing (instability 0), meaning any change there ripples widely but it never changes for upstream reasons.

The main hub is source/engine/main.js — it orchestrates the viewer lifecycle, format registry, and task queue. source/engine/core/localization.js (28 dependents) and source/engine/geometry/coord3d.js (28 dependents) are secondary hubs. Two modules (source/website/utils.js, source/website/settings.js) form a circular import, which complicates refactoring those files.

A run's flow: browser loads website/index.html → source/website/index.js initializes → source/engine/main.js creates a viewer → user drops a file → importer.js dispatches to a format-specific parser → geometry is stored in geometry.js structures → viewer/ renders via three.js. No network calls or database writes occur; all processing is client-side.

How To Use It

Setup (from package.json and package-lock.json):

npm install
npm run build

Running: Open website/index.html in a browser, or serve the directory with any static file server. The npm package online-3d-viewer exposes the library for embedding. No environment variables or configuration files are required.

Embedding: Use the sandbox/embed_iframe.html pattern — initialize with Init3DViewerFromFileList() or Init3DViewerFromUrlList() from source/engine/main.js.

Real-World Use

A procurement team evaluating STEP files from multiple CAD vendors: they drop files into the viewer, use the measurement tools (source/engine/viewer/measure.js) to verify dimensions, and export to GLTF for downstream web AR. The sandbox examples show how to embed this in an internal tool with a custom file host (sandbox/embed_filehost.html).

Code Health & Issues

Static analysis (58 findings: 17 high, 40 medium, 1 low) reports:

High – Import cycle in source/website/utils.js and source/website/settings.js
High – Deep nesting (max depth 7) in utils.js, importer.js, exporter3dm.js
High – Hub modules: geometry.js (33 dependents), main.js (31), localization.js (28)
High – 74 duplicated 6-line blocks across 23 import/export files
Medium – Oversized files: importer3ds.js, importergltf.js, website.js (601+ lines)
Medium – File handle leak in tools/lib/utils.py (no context manager)

SDLC audit adds: CI workflows use unpinned action tags (ncipollo/release-action@v1), no test command in CI despite 245 test files, no Dependabot, npm install instead of npm ci, no dependency scan, and two binaries over 5MB (X_Bot.dae 6.8MB, DamagedHelmet.gltf 4.8MB). No secrets committed, license and lockfile present.

The Bottom Line

This is a production-grade 3D viewer with broad format support and a clean engine/UI split. The fork has no unique additions over upstream yet, so teams should evaluate the original kovacsv/Online3DViewer unless they need this specific fork. The code quality issues are typical for a mature codebase — manageable, but CI needs hardening before trusting its green check.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

655 files

JavaScript145
HTML66
Markdown19
CSS17
Python11
JSON8

React

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["source<br/>111 modules"] g1["test<br/>30 modules"] g2["tools<br/>11 modules"] g3["docs<br/>2 modules"] g1 -->|30| g0

Module dependencies

The 10 most depended-upon modules of 156, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_rce_engine_geometry_geometry["geometry"] n1_source_engine_main["main"] n2_rce_engine_core_localization["localization"] n3_urce_engine_geometry_coord3d["coord3d"] n4_ource_engine_viewer_domutils["domutils"] n5_source_engine_model_color["color"] n6_source_engine_io_fileutils["fileutils"] n7_source_engine_model_material["material"] n8_source_website_utils["utils"] n9__engine_import_importerutils["importerutils"] n3_urce_engine_geometry_coord3d --> n0_rce_engine_geometry_geometry n9__engine_import_importerutils --> n0_rce_engine_geometry_geometry n9__engine_import_importerutils --> n7_source_engine_model_material n9__engine_import_importerutils --> n5_source_engine_model_color n1_source_engine_main --> n2_rce_engine_core_localization n1_source_engine_main --> n3_urce_engine_geometry_coord3d n1_source_engine_main --> n0_rce_engine_geometry_geometry n1_source_engine_main --> n9__engine_import_importerutils n1_source_engine_main --> n6_source_engine_io_fileutils n1_source_engine_main --> n5_source_engine_model_color n1_source_engine_main --> n7_source_engine_model_material n1_source_engine_main --> n4_ource_engine_viewer_domutils n7_source_engine_model_material --> n0_rce_engine_geometry_geometry n7_source_engine_model_material --> n5_source_engine_model_color n8_source_website_utils --> n5_source_engine_model_color n8_source_website_utils --> n4_ource_engine_viewer_domutils n8_source_website_utils --> n2_rce_engine_core_localization classDef cyc stroke:#ef4444,stroke-width:2px; class n8_source_website_utils cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium6

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

ncipollo/release-action@v1

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Make CI invoke the test suite it hashigh243 occurrences

.github/workflows

243 test files, no test command in any workflow

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/build.yml

2 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

npm install with a committed package-lock.json

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

website/assets/models/X_Bot.dae

2 blobs over 5MB: X_Bot.dae 6.8MB, DamagedHelmet.gltf 4.8MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/build.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow3 occurrences

.github/workflows/build.yml

3 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.