node.js - How to run a JavaScript function in a sandbox environment? - Stack Overflow

admin管理员组

文章数量:1344979

I have an application server written in JavaScript(node.js) . I accept a JS function code as an input from the web browser. Now I want to be able to run this function on server without affecting anything else.

I want to make sure that all the variables this function is modifying are local to the function and not affecting any other vars on server.

Also I would like to somehow avoid infinite loops or recursions and any other unforseen problems.

Mostly I would like the user to be able to trigger some code as a function to be run before I take some action.

Any ideas ?

I have an application server written in JavaScript(node.js) . I accept a JS function code as an input from the web browser. Now I want to be able to run this function on server without affecting anything else.

I want to make sure that all the variables this function is modifying are local to the function and not affecting any other vars on server.

Also I would like to somehow avoid infinite loops or recursions and any other unforseen problems.

Mostly I would like the user to be able to trigger some code as a function to be run before I take some action.

Any ideas ?

• javascript
• node.js

Share Improve this question Follow asked Feb 15, 2013 at 6:29 Amogh TalpallikarAmogh Talpallikar 12.2k1515 gold badges8484 silver badges135135 bronze badges 7

• No can do. Once you're running arbitrary code you're doing just that - running arbitrary code. – maerics Commented Feb 15, 2013 at 7:09
• 1 second that! Short of firing a separate node instance, there is not enough in V8 to guarantee full sandboxing. I wish there was! – Pascal Belloncle Commented Feb 15, 2013 at 7:32
• I don't know if jsapp.us runs the code on the server but if so you probably want to check it out! github./matthewfl/node-host – Mattias Commented Feb 15, 2013 at 13:23
• Your best bet is to probably read up on the vm module in node.js. Not sure there's going to be a bullet-proof way to execute arbitrary code, but figured I would at least mention this. – Dominic Barnes Commented Feb 15, 2013 at 14:55
• Does this answer your question? How to run untrusted code serverside? – Jerska Commented Mar 27, 2020 at 10:35

 |  Show 2 more ments

2 Answers 2

Sorted by: Reset to default 7

Sandbox is a node module that according to the README;

• Can be used to execute untrusted code
• Support for timeouts (e.g. prevent infinite loops)
• Restricted code (cannot access node.js methods)

The Halting Problem as @maerics wrote about can be solved by setting a timeout for the code although you can not do that in the same process, because for example while(1) will block it. Sandbox addresses this issue by using a child process.

The variable problem should therefore also be solved because Sandbox is in a child process and not the main process.

As mentioned before, if possible, you should avoid users to run arbitrary code on your server because it es with an huge security risk. Even through the module provides this restrictions you should run at least the child processes with an as unprivileged user as possible.

You cannot programmatically determine if arbitrary code will run indefinitely or terminate.

This is called The Halting Problem.

You might be able to prevent arbitrary JS code from modifying variables other than the ones it creates by sandboxing in a separate process.

Either way, accepting arbitrary code for execution on a server is opening a huge security risk on your system. Think carefully about how you can avoid it.

本文标签： nodejsHow to run a JavaScript function in a sandbox environmentStack Overflow