jsvm
is a secure and fully compatible implementation of the Node.js VM API in pure ECMAScript 5. It has a footprint of 7KB, does not depend on browser technologies such as the DOM. While jsvm
can be used excellently as a webpack shim for vm
, you just could use it instead of vm
in Node.js, too.
jsvm
has been designed with efficiency and security in mind:
- Code is transpiled only on the basis of native
RegExp
tokenization and no AST is created, increasing speed by a huge factor. The cost of initialization is minimal, noiframe
or similar is created at runtime. - Security measures are designed to be immune to extensions of the ECMAScript grammar (non-standard extensions, future extensions). The package works with standardized ES5 features only, making results predictable and security best assessable.
Install this package using NPM:
npm install jsvm
var vm = require('jsvm');
var sandbox = { console };
vm.runInNewContext('console.log("Hello world")', sandbox);
See the Node.js vm
documentation.
jsvm
executes scripts subsequently in the same global scope. No
iframe
or Web Worker is instantiated at runtime and execution is
carried out solely by means of eval
execution of RegExp
-transpiled
code.
To achieve this, from the perspective of an executed script, built-in
global objects (not the global object itself) are
frozen. Any modifications on properties or sub-properties of built-in
objects (such as Object.prototype.toString
)
will be discarded (see the behavior of Object.freeze()
).
jsvm
will not freeze any objects of the host script but create a
separate global scope for execution of virtualized scripts as long as
the executing environment makes it technically viable to create such a
separate global scope. This is the case in Node.js and in a browser.
jsvm
differs from vm
in the following points:
- All scripts run in strict mode (or a superset, depending on browser support).
- Built-in objects (
Object
,Array
,Date
etc.) and their prototypes are immutable.
- The
timeout
option limits the execution time of the script itself but also of functions defined in the script that are called once the main script has terminated, such as events, timeouts etc.
© 2016 Filip Dalüge, all rights reserved.