search

gf3 / sandbox

A nifty JavaScript sandbox for Node.js
ISC License
844 stars 123 forks source link

Add IPC messaging between sandbox and shovel, and fix tests #31

Closed emschwartz closed 10 years ago

emschwartz commented 10 years ago

Sandbox.postMessage sends messages through to the sandboxed code User code can handle incoming messages by defining global onmessage function User code can send messages through to the outside of the sandbox by using global postMessage function Sandbox.on('message', function(message){...}) can be used to handle messages sent by sandboxed code Added tests, example, and documentation

gf3 commented 10 years ago

Thank you!

emschwartz commented 10 years ago

My pleasure.

How would you feel about replacing the holaback pattern with the standard Node.js callback(error, result) pattern? On my fork I'm working on making that change, as well as piping stdout straight through for debugging purposes, and making an option to entirely disable logging. If those are more breaking than you'd be happy integrating then I'll just keep them on my fork. I'm also updating the tests and using chai/expect/sinon.

On Thu, Jun 19, 2014 at 11:26 AM, Gianni Chiappetta < notifications@github.com> wrote:

Thank you!

— Reply to this email directly or view it on GitHub https://github.com/gf3/sandbox/pull/31#issuecomment-46598210.

gf3 commented 10 years ago

I am totally in favour of the callback change. I'm actually rewriting the sandbox in C++ to address some security concerns, so I would hold off with any other major features for the time being. And then once I've released the new version I'd be happy to chat about adding new features.

emschwartz commented 10 years ago

What exactly were the security concerns? And are you writing the whole sandbox in C++ or using another C++ sandbox?

On Thu, Jun 19, 2014 at 11:35 AM, Gianni Chiappetta < notifications@github.com> wrote:

I am totally in favour of the callback change. I'm actually rewriting the sandbox in C++ to address some security concerns, so I would hold off with any other major features for the time being. And then once I've released the new version I'd be happy to chat about adding new features.

— Reply to this email directly or view it on GitHub https://github.com/gf3/sandbox/pull/31#issuecomment-46599363.

gf3 commented 10 years ago

You can read about it here, but basically it's not enough to write the sandbox in javascript with node. I am re-writing the entire sandbox to bypass node entirely for execution and use v8 directly.

emschwartz commented 10 years ago

Hmm, interesting. Do you have the proof of concept?

On Thu, Jun 19, 2014 at 11:39 AM, Gianni Chiappetta < notifications@github.com> wrote:

You can read about it here https://github.com/gf3/sandbox/issues/29, but basically it's not enough to write the sandbox in javascript with node. I am re-writing the entire sandbox to bypass node entirely for execution and use v8 directly.

— Reply to this email directly or view it on GitHub https://github.com/gf3/sandbox/pull/31#issuecomment-46599884.