patriksimek/vm2

v3.10.0 introduced a breaking change

開放

#543 建立於 2025年11月4日

 (1 則留言) (0 個反應) (0 位負責人)JavaScript (285 個分叉)batch import
bugconfirmedhelp wanted

倉庫指標

星標
 (3,798 顆星)
PR 合併指標
 (30 天內沒有已合併 PR)

描述

With our use case we use webpack to bundle code into a single script. This happens with any package that uses inherits or the nodejs util.inherits.

With https://github.com/patriksimek/vm2/pull/540 this broke usage of these packages and it will result in this line throwing https://github.com/patriksimek/vm2/blob/main/lib/setup-sandbox.js#L561.

I am unsure if this change is for security reasons as the PR doesn't go into details.

Here is a minimal script to reproduce the error:

const script = `
const util = require('util');
const EventEmitter = require('events');

function MyStream() {
  console.log("This is sha1");
}

util.inherits(MyStream, EventEmitter);
`;

const vmScript = new VMScript(script);
const vm = new NodeVM({
console: 'inherit',
require: {
  builtin: ['util', 'events'],
},
});
vm.run(vmScript);

貢獻者指南