joshuawise / expression-sandbox Goto Github PK

Obviously, we can't solve this.

But we do need some way to interrupt things like while(1)

I think the only way around this is to use an iframe or webworker...

I have toyed with injecting yield into the payload (using a babel plugin) but I never got all the edges sorted out... You can walk the function and look for WhileStatement (etc) and insert a yield at the start of every block then when we run our untrusted code...

const untrusted = `
  let i = 0;
  while(true) {i++}
`

const userCodeAfterAstTransform = new Function(`return function* () {
  try {
    let i = 0;
    while(yield) {
      yield i++
    }
  } catch (e) {
    yield {error: e};
  }
}`)();

function run(it, callback) {
  requestIdleCallback(deadline => {
    let val = it.next();
    while (!val.done) {
      if (deadline.timeRemaining() <= 0) {
        run(it, callback);
        return;
      }
      val = it.next();
    }
    callback(val.value);
  });
}

run(userCodeAfterAstTransform(), log);

I'd like to use an expression-sandbox for implementing secured mode in Klipse.

I have tried the naive approach suggested in https://blog.risingstack.com/writing-a-javascript-framework-sandboxed-code-evaluation/

Do you think that expression-sandbox could be helpful?

I have played with it a bit. The problem is that

Sandboxes are only allowed to return primitive values

and

You cannot set properties on a sandboxed object.

Here's a more complete list of standard constructors for you:

const constructors = [
  Array,
  ArrayBuffer,
  Boolean,
  Date,
  Error,
  EvalError,
  Float32Array,
  Float64Array,
  Function,
  Int8Array,
  Int16Array,
  Int32Array,
  Map,
  Number,
  Object,
  RangeError,
  ReferenceError,
  RegExp,
  Set,
  String,
  SyntaxError,
  TypeError,
  Uint8Array,
  Uint8ClampedArray,
  Uint16Array,
  Uint32Array,
  URIError,
  WeakMap,
  WeakSet
];

I have a fairly bizarre use-case, but it's causing a problem. I have a section of code that mimics inheriting from Function, which involves creating a mock "prototype," and creating a mock property called "constructor," then copying these over to a function(). The problem is, once I run require('expression-sandbox') it freezes the Javascript native prototypes, so I get an error that I'm trying to write to a read-only property (constructor).

Looking through your code, my thought is, is there a way to do all the freezing right before running the sandboxed expression, then unfreezing when the execution is finished, rather than freezing everything when the module loads and then leaving it like it currently does? That would solve my problem I believe.

Thanks.

Code in Node.js v8.7.0:

   this.name = 'AssertionError [ERR_ASSERTION]';

https://github.com/nodejs/node/blob/dc4f1b981a888a2f39219d384b6d3eb593203383/lib/internal/errors.js#L53

The error message is: TypeError: Cannot assign to read only property 'name' of object 'Error: false == true'

Any ideas?

I'm trying to provide a write function to my sandbox.

The write command in itself is pretty complex and written in TypeScript, so I won't post it.

The sandboxed code looks like this:

var code = compiler('(function () { try { \
\
    write("Hello World!\\n>"); \
\
} catch(err) { log(err) } })()');

and I run it like this:

    code({
        write: function(msg: string) {
            terminalObj.write(msg);
        },
        log: function(msg: any) {
            console.info(msg);
        }
    });

Now what happens is that within my terminalObj.write is e.g. a slice on an array of numbers that is a property of my terminalObj. Right at the slice (I've narrowed it down to just the slice) the sandbox kicks in and claims: "Error: You cannot set properties on a sandboxed object"

Here is a screenshot I took from apply right before the set function will throw the top exception with the error message above:

Hi,

I would like to compile code like this:

const myFunc = '
const res = {};
res.email = '[email protected]';
res.email2 = 'faker.internet.email()';
return JSON.stringify(res);
'
const code = compiler(myFunc);
const result = code({ JSON });
console.log(result);

But this does not work because of the hardcoded 'return' statement. Is there a way to compile code like this?

Or would you accept a pull request with an additional compile function?