3

I have an application server written in JavaScript(node.js) . I accept a JS function code as an input from the web browser. Now I want to be able to run this function on server without affecting anything else.

I want to make sure that all the variables this function is modifying are local to the function and not affecting any other vars on server.

Also I would like to somehow avoid infinite loops or recursions and any other unforseen problems.

Mostly I would like the user to be able to trigger some code as a function to be run before I take some action.

Any ideas ?

Improve this question
7
  • No can do. Once you're running arbitrary code you're doing just that - running arbitrary code. Commented Feb 15, 2013 at 7:09
  • 1
    second that! Short of firing a separate node instance, there is not enough in V8 to guarantee full sandboxing. I wish there was! Commented Feb 15, 2013 at 7:32
  • I don't know if jsapp.us runs the code on the server but if so you probably want to check it out! github.com/matthewfl/node-host Commented Feb 15, 2013 at 13:23
  • Your best bet is to probably read up on the vm module in node.js. Not sure there's going to be a bullet-proof way to execute arbitrary code, but figured I would at least mention this. Commented Feb 15, 2013 at 14:55
  • Does this answer your question? How to run untrusted code serverside? Commented Mar 27, 2020 at 10:35

2 Answers 2

Reset to default
7

Sandbox is a node module that according to the README;

  • Can be used to execute untrusted code
  • Support for timeouts (e.g. prevent infinite loops)
  • Restricted code (cannot access node.js methods)

The Halting Problem as @maerics wrote about can be solved by setting a timeout for the code although you can not do that in the same process, because for example while(1) will block it. Sandbox addresses this issue by using a child process.

The variable problem should therefore also be solved because Sandbox is in a child process and not the main process.

As mentioned before, if possible, you should avoid users to run arbitrary code on your server because it comes with an huge security risk. Even through the module provides this restrictions you should run at least the child processes with an as unprivileged user as possible.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

3

You cannot programmatically determine if arbitrary code will run indefinitely or terminate.

This is called The Halting Problem.

You might be able to prevent arbitrary JS code from modifying variables other than the ones it creates by sandboxing in a separate process.

Either way, accepting arbitrary code for execution on a server is opening a huge security risk on your system. Think carefully about how you can avoid it.

Improve this answer

1 Comment

I might keep a timeout for infinite execution. its the vars I am worried about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.