On 16/01/2013, at 22:24, Gustavo Machado wrote: > Hello, > > We are building a platform that is oriented to developers in node.js, and we > are in the process of evaluating giving our users the ability to configure > validation and authorisation rules in Javascript. > > On virtually every request, these validation rules are going to be executed, > so it needs to be somewhat performant, but most importantly "safe". And by > safe I mean: > > - no require-ing > - no access to global > - any kind of attack that may give access to the local system (files, > network, etc) > > So far, we found the "sandbox" module: > https://github.com/gf3/sandbox/blob/master/example/example.js but are looking > for some other choices. > > Thanks, > Gustavo Machado
V8 Isolates run isolated code, share nothing with node's JS context and don't have any means for IO. With Threads A GoGo (<https://github.com/xk/node-threads-a-gogo/>) you can create a JS thread that runs in a V8 isolate, pass it a function (serialized, as text), execute it with some parameters (serialized, as text), and get back a result (serialized, as text). The only means for IO a thread in TAGG has are: 1.- The built-in `puts(text)` cmd that writes to stdout, but it can be deleted. 2.- The thread.emit() method, but it can be deleted as well. So basically the clients' code you could run with 100% safety in a TAGG thread could be +/- a function like this: function clientProcedure (data) { //process data return result; } And you'd do it so: var aThread= require('threads-a-gogo').create() .eval('delete puts') .eval('delete thread.emit') .eval('(' + clientProcedure + ')(' + data + ')', cb); function cb (result) { //here you'd receive the result of clientProcedure(data); aThread.destroy(); } -- Jorge. -- Job Board: http://jobs.nodejs.org/ Posting guidelines: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines You received this message because you are subscribed to the Google Groups "nodejs" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/nodejs?hl=en?hl=en
