patriksimek/vm2

Support for running vm2 in browser

Open

#85 opened on Jul 30, 2017

View on GitHub
 (19 comments) (22 reactions) (0 assignees)JavaScript (3,798 stars) (285 forks)batch import
feature requesthelp wanted

Description

Branch: https://github.com/patriksimek/vm2/tree/feature-browsers Library: https://github.com/patriksimek/vm2/blob/feature-browsers/dist/vm2.js

Usage

<script src="vm2.js"></script>
<script>
    const vm = new vm2.VM();
    alert(vm.run('Math.random()'));
</script>

Issues

  • Sandbox can be escaped via window.top.

TODO

  • Remove NodeVM from browser version.
  • Add BrowserVM to browser version with browser related features.
  • Automated browser tests.

Contributor guide

Tech stack
javascript
Domain
frontendsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
JavaScriptBrowser securitySandboxing
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Examine the existing branch 'feature browsers' and the dist/vm2.js file to understand current browser support. Investigate the window.top sandbox escape and research browser specific sandboxing techniques. Then implement removal of NodeVM, addition of BrowserVM with browser specific features, and write automated browser tests as outlined in the TODO list.