Add comprehensive research on Node.js sandboxing capabilities

[simonw]

Summary

This PR adds extensive research documentation and working examples for sandboxing untrusted JavaScript code using Node.js v22 built-in modules and third-party packages. The research covers worker_threads, the Permission Model, vm module, and npm packages like isolated-vm.

Key Changes

Documentation

• worker-threads-sandboxing/README.md: Comprehensive guide covering Worker constructor options, resourceLimits behavior, Node.js Permission Model (now stable in v22), vm module limitations, and combined defense-in-depth approaches
• sandbox-worker-threads/README.md: Practical investigation results with verdict on each sandboxing mechanism (resourceLimits unreliable, Permission Model effective, vm not a security boundary)
• js-sandbox-research/README.md: Analysis of third-party packages including isolated-vm (recommended), vm2 (deprecated with 20+ CVEs), and quickjs-emscripten
• Research notes in both directories documenting methodology and findings

Working Examples

• 01-01f series: Tests of resourceLimits showing they do NOT effectively enforce memory limits in Node.js 22 (workers exceed stated limits by 10-20x)
• 02-02b series: Permission Model tests confirming --experimental-permission via execArgv successfully blocks filesystem writes and child process spawning
• 03-03b series: vm module isolation tests demonstrating the constructor escape vulnerability
• 04: CPU timeout prevention via worker.terminate() and vm timeout
• 05: Permission Model inheritance testing on main process
• 06: isolated-vm integration showing true V8 isolate separation
• 07-07f series: Combined defense-in-depth approaches (Permission Model + vm, Permission Model + isolated-vm, escape testing)

Notable Implementation Details

• resourceLimits verdict: Guidelines rather than hard limits; ArrayBuffer allocations bypass them entirely; --max-old-space-size cannot be passed via execArgv
• Permission Model: Now stable (not experimental) in Node.js v22.13.0+; can be applied per-worker via execArgv; provides syscall-level enforcement even if vm sandbox is escaped
• vm module: Explicitly NOT a security mechanism; any injected function enables prototype chain escape to access process/require
• isolated-vm: Recommended for true isolation; uses separate V8 isolates with independent heaps; requires --allow-addons permission flag
• Combined approach: Worker + Permission Model + isolated-vm provides strongest sandboxing with filesystem restrictions, memory limits, and CPU timeouts

All examples are tested and functional on Node.js v22.22.0.

https://claude.ai/code/session_019VCn2aGgVfuSqP4qK2G4Lf

[simonw]

You wrote a lot of code but did not include details of exactly how you ran that code and the results you got from it in the repo - make sure the README includes detailed information on the tests you ran and what you learned from them