2

I have an application server written in JavaScript(node.js) . I accept a JS function code as an input from the web browser. Now I want to be able to run this function on server without affecting anything else.

I want to make sure that all the variables this function is modifying are local to the function and not affecting any other vars on server.

Also I would like to somehow avoid infinite loops or recursions and any other unforseen problems.

Mostly I would like the user to be able to trigger some code as a function to be run before I take some action.

Any ideas ?

Amogh Talpallikar
  • 11,904
  • 13
  • 78
  • 134
  • No can do. Once you're running arbitrary code you're doing just that - running arbitrary code. – maerics Feb 15 '13 at 07:09
  • 1
    second that! Short of firing a separate node instance, there is not enough in V8 to guarantee full sandboxing. I wish there was! – Pascal Belloncle Feb 15 '13 at 07:32
  • I don't know if http://jsapp.us/ runs the code on the server but if so you probably want to check it out! https://github.com/matthewfl/node-host – Mattias Feb 15 '13 at 13:23
  • Your best bet is to probably read up on the [vm module](http://nodejs.org/docs/latest/api/vm.html) in node.js. Not sure there's going to be a bullet-proof way to execute arbitrary code, but figured I would at least mention this. – Dominic Barnes Feb 15 '13 at 14:55
  • Does this answer your question? [How to run untrusted code serverside?](https://stackoverflow.com/questions/10937870/how-to-run-untrusted-code-serverside) – Jerska Mar 27 '20 at 10:35
  • @Jerska What's point of this 7 years later? I don't even remember why I asked it. – Amogh Talpallikar Mar 27 '20 at 12:54
  • This is an automatic message when flagging as a duplicate. There are many questions about the same topic, and I flagged them as duplicates to link them together. – Jerska Mar 27 '20 at 19:12

2 Answers2

4

Sandbox is a node module that according to the README;

  • Can be used to execute untrusted code
  • Support for timeouts (e.g. prevent infinite loops)
  • Restricted code (cannot access node.js methods)

The Halting Problem as @maerics wrote about can be solved by setting a timeout for the code although you can not do that in the same process, because for example while(1) will block it. Sandbox addresses this issue by using a child process.

The variable problem should therefore also be solved because Sandbox is in a child process and not the main process.

As mentioned before, if possible, you should avoid users to run arbitrary code on your server because it comes with an huge security risk. Even through the module provides this restrictions you should run at least the child processes with an as unprivileged user as possible.

Community
  • 1
  • 1
Mattias
  • 8,871
  • 3
  • 40
  • 42
2

You cannot programmatically determine if arbitrary code will run indefinitely or terminate.

This is called The Halting Problem.

You might be able to prevent arbitrary JS code from modifying variables other than the ones it creates by sandboxing in a separate process.

Either way, accepting arbitrary code for execution on a server is opening a huge security risk on your system. Think carefully about how you can avoid it.

maerics
  • 143,080
  • 41
  • 260
  • 285