Executing user created function safely within Node.js

Question

I would like to add a feature to my site that gives users the ability to create custom JavaScript functions that would run on a Node.js server. Users would upload the JS function and I would eval to code and use it's return value somehow on the server. However, this is an obvious security hole. Is there someway in JavaScript/ Node.js to only allow a function to have scope to only parameters given to it? I don't want it to have access to variables else where in the server.

Thanks in advance.

eval is a great security risk on the browser itself, how much more on the server? — Joseph
– Joseph, Commented Mar 30, 2012 at 0:50

stewe · Accepted Answer · 2012-03-30 00:56:57Z

5

Have a look at:

vm.runInNewContext(code, [sandbox], [filename])

answered Mar 30, 2012 at 0:56

stewe

42.8k13 gold badges82 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Eddie Over a year ago

Thanks, this opens up a world of possibilities.

scaryguy Over a year ago

@Eddie: Any possibility that you could accept his answer if it worked for you?

Collectives™ on Stack Overflow

Executing user created function safely within Node.js

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related