Safely sandbox and execute user submitted JavaScript?

by

You can use sandbox support in nodejs with vm.runInContext(‘js code’, context), sample in api documentation:

https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_options

const util = require('util');
const vm = require('vm');

const sandbox = { globalVar: 1 };
vm.createContext(sandbox);

for (var i = 0; i < 10; ++i) {
    vm.runInContext('globalVar *= 2;', sandbox);
}
console.log(util.inspect(sandbox));

// { globalVar: 1024 }

WARN: As pointed by “s4y” it seems to be flawled. Please look at the comments.

More Related Contents:

  1. Why {} + {} is NaN only on the client side? Why not in Node.js?
  2. How do I completely uninstall Node.js, and reinstall from beginning (Mac OS X)
  3. Client on Node.js: Uncaught ReferenceError: require is not defined
  4. Error: request entity too large
  5. How to parse JSON using Node.js? [closed]
  6. Asynchronous exception handling with bluebird promises
  7. How to format a UTC date as a `YYYY-MM-DD hh:mm:ss` string using NodeJS?
  8. Using socket.io in Express 4 and express-generator’s /bin/www
  9. Calling a JSON API with Node.js
  10. What is the best way to limit concurrency when using ES6’s Promise.all()?
  11. getting how many people are in a chat room in socket.io [duplicate]
  12. How to convert CSV to JSON in Node.js
  13. Reading Excel file using node.js
  14. How do I measure the execution time of JavaScript code with callbacks?
  15. Manipulating the local file system with browser-based JavaScript and Node
  16. How to get updated document back from the findOneAndUpdate method?
  17. How do I add an action to watson conversation response?
  18. Firebase – Get Random Child From Database Node
  19. Loop through asynchronous request
  20. Restricting eval() to a narrow scope
  21. Why the open quote and bracket for eval(‘(‘ + jsonString+ ‘)’) when parsing json string
  22. Error: 10 ABORTED: Too much contention on these documents. Please try again
  23. How to mock Axios with Jest?
  24. Does every object in JS have a toString() method?
  25. Promise.all().then() resolve?
  26. Where argument of first next() call goes? [duplicate]
  27. How to generate unique ID with node.js
  28. execute some code and then go into interactive node
  29. How to bind methods when destructuring an object in JavaScript?
  30. Error when requiring discordjs: “cannot find module ‘node:events'” [duplicate]

Leave a Comment