vm2

vm2 is a sandbox that can run untrusted code with whitelisted built-in node objects. Securely!.

vm2

vm2 is a sandbox that can run untrusted code with whitelisted built-in node objects. Securely!

  • Runs untrusted code securely in a single process with your code side by side
  • Full control over sandbox's console output
  • Sandbox has limited access to process's methods
  • Sandbox can require modules (native and external)
  • You can limit access to certain (or all) native modules
  • You can securely call methods inside sandbox with callbacks
  • Is immune to while (true) {}
  • Is immune to all known methods of attacks
  • Coffee-Script support
  • It uses internal VM module to create secure context
  • It compiles native modules inside a new context
  • It overrides native require to control access to modules
  • It forces modules (even native ones) to use use strict

IMPORTANT: Requires Node.js 0.11+ / io.js 1.0+

npm install vm2
var VM = require('vm2').VM;
 
var vm = new VM();
vm.run("process.exit()");

VM is a simple sandbox, without require feature, to synchronously run an untrusted code. Only JavaScript built-in objects are available.

Options:

  • timeout - Script timeout in milliseconds
  • sandbox - VM's global object
  • language - javascript (default) or coffeescript
var VM = require('vm2').VM;
 
var options = {
    timeout: 1000,
    sandbox: {}
};
 
var vm = new VM(options);
vm.run("process.exit()");

Unlike VM, NodeVM lets you require modules same way like in regular Node's context.

Options:

  • console - inherit to enable console, redirect to redirect to events, off to disable console (default: inherit)
  • sandbox - VM's global object
  • language - javascript (default) or coffeescript
  • require - true to enable require method (default: false)
  • requireExternal - true to enable require of external modules (default: false)
  • requireNative - Array of allowed native modules. (default: all available)

Available modules: assert, buffer, child_process, crypto, tls, dgram, dns, http, https, net, querystring, url, domain, events, fs, path, os, stream, string_decoder, timers, tty, util, sys, vm, zlib

Remember: the more modules you allow, the more fragile your sandbox becomes.

var NodeVM = require('vm2').NodeVM;
 
var options = {
    console: 'inherit',
    sandbox: {},
    require: true,
    requireExternal: true,
    requireNative: ['fs', 'path']
};
 
var vm = new NodeVM(options);
var functionInSandbox = vm.run("module.exports = function(who) { console.log('hello '+ who); }");

Securely call method in sandbox. All arguments except functions are cloned during the process to prevent context leak. Functions are wrapped to secure closures. Buffers are copied.

IMPORTANT: Method doesn't check for circular objects! If you send circular structure as an argument, your process will stuck in infinite loop.

IMPORTANT: Always use vm.call method to call methods or callbacks in sandbox. If you call it directly, you are exposing yourself a risk of main global context leakage!

vm.call(functionInSandbox, 'world');

Before you can use vm2 in command line, install it globally with npm install vm2 -g.

$ vm2 ./script.js

Copyright (c) 2014 Patrik Simek

The MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.