Skip to content
A secure require implementation for ECMAScript
Branch: master
Clone or download
Latest commit 4bc08ae Jun 5, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.circleci Add a simple CircleCI config Jun 4, 2019
lib C O M P A T I B I L I T Y Jun 4, 2019
test Add benchmarks Jun 5, 2019
.gitignore Fix ignore rules May 31, 2019
.npmignore Fix ignore rules May 31, 2019
LICENSE Initial commit May 31, 2019
README.md Add CircleCI README badge Jun 4, 2019
jest.config.js Add tests to ensure that the module does infact help May 31, 2019
package-lock.json Add benchmarks Jun 5, 2019
package.json Add benchmarks Jun 5, 2019
tsconfig.json Add dist to excludes May 31, 2019

README.md

secure-require

A secure require implementation for ECMAScript

npm CircleCI

Feel more confident running a bunch of untrusted dependencies as a part of your application or module by allowing said dependency to only use a subset of core APIs. This allows you to make sure that none of the sub-dependencies try anything unexpected, or are able to alter the global objects of your own application code, no matter which version you upgrade to.

Notice

I'd like to humbly request you to please refrain from using this module anyplace critical since it hasn't been audited properly and is still undergoing massive changes. You should be able to better rely on it once the v1.x is released.

Security Model

  • Full global isolation: Each top-level dependency is run in a separate container.
  • Safely restrict the require tree to only a subset of allowed modules, including restricting Node.js core access.

Features

  1. Zero dependencies (wouldn't that be ironic).
  2. Uses the same stuff require uses behind-the-scenes, so performance dip should be next to none.
  3. Supports core, third party and local modules.
  4. Cache modules in the same context so that you get close to the speed of the original require function without losing any of the security guarantees.

Imposed Restrictions (Incompatibilities)

The following are the security restrictions that are imposed by the function on your dependencies to your ensure safety. In case you disagree with any of these, or have a valid use case for doing any of the following that you believe should be supported, please do not hesitate to reach out.

  1. A dependency cannot make use of any core module which isn't whitelisted throughout it's subtree (duh).
  2. Since modules are compiled in seperate VM Contexts, monkey-patching globals will not work.
  3. When a module requires a core module, they cannot set any property anywhere on that core module.
  4. The use of module.require is forbidden.
  5. No module can require the Module class anywhere down the chain.

Installation

npm i secure-require

Usage

const secureRequire = require('secure-require');
// Since secure-require doesn't have any dependencies, this should be fine.
secureRequire('acorn', []);
// This should pass since acorn is written without any dependencies or core modules.
secureRequire('base', []);
// This should fail since base requires the util core module.
secureRequire('base', ['util']);
// This should pass since we just allowed base to use the util module. Now, we
// need not worry about base doing anything funny with the filesystem or the
// network. It literally cannot.

License

MIT

You can’t perform that action at this time.