Run external plugins in sandbox

lib/hexo/index.js

@@ -119,7 +119,6 @@ Hexo.prototype.init = function(){
     // Load external plugins & scripts
     return Promise.all([
       require('./load_plugins')(self),
-      require('./load_scripts')(self),
       require('./update_package')(self)
     ]);
   }).then(function(){

lib/hexo/load_plugins.js

@@ -1,23 +1,83 @@
 var pathFn = require('path');
 var fs = require('hexo-fs');
+var tildify = require('tildify');
+var Promise = require('bluebird');
+var vm = require('vm');
+var Module = require('module');
+
+var pre = '(function(exports, require, module, __filename, __dirname, hexo){';
+var post = '});';
 
 require('colors');
 
 module.exports = function(ctx){
   if (!ctx.env.init || ctx.env.safe) return;
 
+  return Promise.all([
+    loadModules(ctx),
+    loadScripts(ctx)
+  ]);
+};
+
+function runInContext(ctx, path){
+  return fs.readFile(path).then(function(script){
+    // Based on: https://github.com/joyent/node/blob/v0.10.33/src/node.js#L516
+    var module = new Module(path);
+    module.filename = path;
+    module.paths = Module._nodeModulePaths(path);
+
+    function require(path){
+      return module.require(path);
+    }
+
+    require.resolve = function(request){
+      return Module._resolveFilename(request, module);
+    };
+
+    require.main = process.mainModule;
+    require.extensions = Module._extensions;
+    require.cache = Module._cache;
+
+    var fn = vm.runInThisContext(pre + script + post, path);
+
+    return fn(module.exports, require, module, path, pathFn.dirname(path), ctx);
+  });
+}
+
+function loadModules(ctx){
   var pluginDir = ctx.plugin_dir;
-  var currentName = '';
 
   return fs.exists(pluginDir).then(function(exist){
     return exist ? fs.readdir(pluginDir) : [];
   }).filter(function(name){
     return name.slice(0, 5) === 'hexo-';
   }).map(function(name){
-    currentName = name;
-    require(pathFn.join(pluginDir, name));
-    ctx.log.debug('Plugin loaded: %s', name.magenta);
-  }).catch(function(err){
-    ctx.log.error({err: err}, 'Plugin load failed: %s', currentName.magenta);
+    var path = require.resolve(pathFn.join(pluginDir, name));
+
+    return runInContext(ctx, path).then(function(){
+      ctx.log.debug('Plugin loaded: %s', name.magenta);
+    }, function(err){
+      ctx.log.error({err: err}, 'Plugin load failed: %s', name.magenta);
+    });
+  });
+}
+
+function loadScripts(ctx){
+  return Promise.filter([
+    ctx.script_dir,
+    ctx.theme_script_dir
+  ], function(scriptDir){
+    return scriptDir ? fs.exists(scriptDir) : false;
+  }).map(function(scriptDir){
+    var path = '';
+
+    return fs.listDir(scriptDir).map(function(name){
+      path = pathFn.join(scriptDir, name);
+      return runInContext(ctx, path);
+    }).then(function(){
+      ctx.log.debug('Script loaded: %s', tildify(path).magenta);
+    }, function(err){
+      ctx.log.error({err: err}, 'Script load failed: %s', tildify(path).magenta);
+    });
   });
-};
+}

lib/plugins/tag/include_code.js

@@ -1,4 +1,4 @@
-var fs = require('graceful-fs'),
+var fs = require('hexo-fs'),
   pathFn = require('path'),
   util = require('../../util'),
   file = util.file2,

test/scripts/helpers/number.js

@@ -3,26 +3,24 @@ var should = require('chai').should();
 describe('number', function(){
   var number = require('../../../lib/plugins/helper/number');
 
-  describe('number_format', function(){
-    it('default', function(){
-      number.number_format(1234.567).should.eql('1,234.567');
-    });
+  it('default', function(){
+    number.number_format(1234.567).should.eql('1,234.567');
+  });
 
-    it('precision', function(){
-      number.number_format(1234.567, {precision: false}).should.eql('1,234.567');
-      number.number_format(1234.567, {precision: 0}).should.eql('1,234');
-      number.number_format(1234.567, {precision: 1}).should.eql('1,234.6');
-      number.number_format(1234.567, {precision: 2}).should.eql('1,234.57');
-      number.number_format(1234.567, {precision: 3}).should.eql('1,234.567');
-      number.number_format(1234.567, {precision: 4}).should.eql('1,234.5670');
-    });
+  it('precision', function(){
+    number.number_format(1234.567, {precision: false}).should.eql('1,234.567');
+    number.number_format(1234.567, {precision: 0}).should.eql('1,234');
+    number.number_format(1234.567, {precision: 1}).should.eql('1,234.6');
+    number.number_format(1234.567, {precision: 2}).should.eql('1,234.57');
+    number.number_format(1234.567, {precision: 3}).should.eql('1,234.567');
+    number.number_format(1234.567, {precision: 4}).should.eql('1,234.5670');
+  });
 
-    it('delimiter', function(){
-      number.number_format(1234.567, {delimiter: ' '}).should.eql('1 234.567');
-    });
+  it('delimiter', function(){
+    number.number_format(1234.567, {delimiter: ' '}).should.eql('1 234.567');
+  });
 
-    it('separator', function(){
-      number.number_format(1234.567, {separator: '*'}).should.eql('1,234*567');
-    });
+  it('separator', function(){
+    number.number_format(1234.567, {separator: '*'}).should.eql('1,234*567');
   });
 });