What are the options for running (possibly malicious) user-submitted scripts in node.js, securely? I.e. in an environment that prevents code from accessing sensitive data a
There is a newer module on github called vm2 that addresses some of these concerns, especially in Node.JS applications. Maybe that will help some others find it, as I have just done.
You should always run untrusted code in a separate process, which is exactly what the sandbox module does. A simple reason is that vm.runInNewContext('while(true){}', {})
will freeze node.
It starts by spawning a separate process, which will later send the result serialized to JSON on its stdout. The parent process continues executing regardless of what the child does and can trigger a timeout.
The untrusted code is then wrapped in a closure with strict mode (in regular JavaScript, you can use arguments.callee.caller
to access data outside of your scope). Finally, a very limited global
object is passed to prevent access to node's API. The untrusted code can only do basic computation and has no access to files or sockets.
While you should read sandbox's code as an inspiration, I wouldn't recommend using it as is:
For increased security, you could also consider using setuid-sandbox. It's the code used by Google Chrome to prevent tab processes from accessing the file system. You would have to make a native module, but this example seems straightforward.