search

davideicardi / live-plugin-manager

Plugin manager and installer for Node.JS
MIT License
238 stars 44 forks source link

Sandbox env and global security concerns #96

Open yogevlahyani opened 2 weeks ago

yogevlahyani commented 2 weeks ago

I plan on using this package to allow all users to develop their plugins and run it within my machine and I have some security concerns, so I'm testing my own using Nexus.

Using sandbox custom env works, but when I install an npm package that uses require('process'), the package can access the environment variables.

const manager = new PluginManager({
    sandbox: {
        env: {},
    },
});

console.log(process.env) // {}

const { env } = require('process'); // or node:process
console.log(env) // all environment variables are being logged

Another concern of mine is the global object, I believe it contains some unnecessary functions and sensitive data, the sandbox option is not well-documented as far as I saw but I wonder what can I do to minimize the security risks involved in using this package and let users run unsafe code within my machine.

davideicardi commented 2 weeks ago

For now, live-plugin-manager should be used when you trust the plugins that you are going to install. If plugins are not safe, you can potentially compromise the entire system.

Probably we can implement some better security check, but in my opinion it will be very difficult to avoid all kinds of security problems.

yogevlahyani commented 2 weeks ago

For now, live-plugin-manager should be used when you trust the plugins that you are going to install. If plugins are not safe, you can potentially compromise the entire system.

Probably we can implement some better security check, but in my opinion it will be very difficult to avoid all kinds of security problems.

Ok, thank you for the responsiveness! So I guess my solution would be to avoid letting users install whatever they want and monitor manually the plugins they're creating, pull requests for example, etc...

Are there any plans for the future to increase security and handle these kinds of cases?

davideicardi commented 1 week ago

Are there any plans for the future to increase security and handle these kinds of cases?

No, to be honest for now I don't have any plan. But I will be more than happy to accept pull requests or any other help.