5 ms·
Ask HN: What options are there for executing untrusted code in Node.js?
Over the past couple of weeks while prototyping various ideas I've kept on running into a hurdle when it comes to trying to run untrusted JavaScript code in Node.JS.
One solution I found early on was Sandbox (http://gf3.github.io/sandbox/), which seems to be fairly safe security wise, but doesn't offer much else.
Node.JS also has a vm module (http://nodejs.org/api/vm.html), but it it is 'Unstable'.
I've also come across sandboxed-module (https://github.com/felixge/node-sandboxed-module), however I can't figure out what it actually does, and also js.js (https://github.com/jterrace/js.js), but it's much too slow to be of much use.
So, does anyone else know of any other solutions?
- egfx 12y agoI never ended up using it but take a look at https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer https://code.google.com/p/google-caja/wiki/JsHtmlSanitizer and there is a node wrapper here https://www.npmjs.org/package/google-caja https://www.npmjs.org/package/google-caja Funny about Node Sandbox. I was fluctuating from grasping it completely to asking wtf is this myself, lol.
- thomasfoster96 12y agoI'll have a look at Google Caja, thanks.
- arghbleargh 12y agoWhat about Sandbox doesn't suit your needs?
- thomasfoster96 12y agoIt'd be great to be able to access the scope of the sandboxed code from the script using the sandbox. I vaguely remember another sandbox-like project having this as a feature, but I can't remember the project name. Sandbox doesn't really offer much in this department except for concatenating variable declarations to the start of the untrusted code, which isn't exactly nice to work with.
- fabulist 12y agoPerhaps if those tools aren't meeting your needs, you could run the Node interpreter in a sandbox, instead.