patriksimek/vm2

v3.10.0 introduced a breaking change

Open

#543 创建于 2025年11月4日

在 GitHub 查看
 (1 评论) (0 反应) (0 负责人)JavaScript (285 fork)batch import
bugconfirmedhelp wanted

仓库指标

Star
 (3,798 star)
PR 合并指标
 (30 天内没有已合并 PR)

描述

With our use case we use webpack to bundle code into a single script. This happens with any package that uses inherits or the nodejs util.inherits.

With https://github.com/patriksimek/vm2/pull/540 this broke usage of these packages and it will result in this line throwing https://github.com/patriksimek/vm2/blob/main/lib/setup-sandbox.js#L561.

I am unsure if this change is for security reasons as the PR doesn't go into details.

Here is a minimal script to reproduce the error:

const script = `
const util = require('util');
const EventEmitter = require('events');

function MyStream() {
  console.log("This is sha1");
}

util.inherits(MyStream, EventEmitter);
`;

const vmScript = new VMScript(script);
const vm = new NodeVM({
console: 'inherit',
require: {
  builtin: ['util', 'events'],
},
});
vm.run(vmScript);

贡献者指南