search

laverdet / isolated-vm

Secure & isolated JS environments for nodejs
ISC License
2.03k stars 147 forks source link

Disable completely code generation from strings? #311

Open QuiiBz opened 1 year ago

QuiiBz commented 1 year ago

Thanks for creating this amazing library. I wonder how we can disable completely code generation from strings?

It's disabled by default here: https://github.com/laverdet/isolated-vm/blob/19b3624b962c13526f78949fd8a6391895a9463d/src/isolate/environment.cc#L482

But then is allowed in the CodeGenCallback: https://github.com/laverdet/isolated-vm/blob/19b3624b962c13526f78949fd8a6391895a9463d/src/isolate/environment.cc#L128

I don't really understand why the above is set to true, which allows executing code within eval(), new Function(), ... Shouldn't it be set to false instead? Initially found in https://github.com/lagonapp/lagon/pull/84

laverdet commented 1 year ago

We use the callback and the flag as a means to prevent OOM memory crashes, rather than as a hardening feature.