Short answer: If you want to be completely safe, you need to use OS-level security (chroot, etc) (and possibly still need to block out network communication and such).
Longer answer: There are other less extreme (still in your process) methods that more limit what a user can do. At Cloud Party (no longer running since our team was acquired by Yahoo Games) we allowed users to script game objects with Javascript and secured it by parsing the Javascript into a syntax tree (I think we used uglify for that), and applied an incredibly strict white list (really creating a butchered subset of the language that only looks like Javascript ;). Initially we allowed no function declarations (could only call our API functions), no for/do/while loops (otherwise they could hang forever), and had to wrap object property access (to prevent getting at things like .__proto, etc), and eventually expanded our system to insert some hooks to detect loops/recursive functions/etc which were spinning out of control. Assuming your use case isn't as real-time as ours was (needed to be running thousands of little scripts up to 30 times a second each), I'd probably go the route of spawning a separate node process in a chroot to run your user's code (wrapped appropriately so they can't get at require/module/process/etc if you want to block network access and such). There is quite a bit of overhead to spawning a new process though, of course. - Jimb On Thursday, July 31, 2014 7:00:29 AM UTC-7, Norman Paniagua wrote: > > Hi, I've a dilema, recently I was create a simple BaaS, it works fine, its > build with koa and node 0.11 with harmony flags, but don't know how to > build a system that let users upload their Nodejs scripts (not full apps, > just simple javascript triggers for the database, like before save and > after save) but how can I build a sandbox so the script only access the > resources that I provide and not the entire server. > > I was thinking this maybe its not all related to Nodejs but also to > virtualising environments with something like docker or similar, but if > there is a pure Nodejs way I want to know. > > Regards > -- Job board: http://jobs.nodejs.org/ New group rules: https://gist.github.com/othiym23/9886289#file-moderation-policy-md Old group rules: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines --- You received this message because you are subscribed to the Google Groups "nodejs" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/nodejs/f00fb5d6-32fb-4421-b162-6377cc190736%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
