vm: runInThisContext is missing require
#9211
Comments
|
See http://stackoverflow.com/questions/20899863/the-module-property-is-undefined-when-using-vm-runinthiscontext. Specifically, try something like this: test.js - var m = require('module');
var src = 'exports.check = require instanceof Function';
var res = require('vm').runInThisContext(m.wrap(src))(exports, require, module, __filename, __dirname);
console.log(module.exports);If you then |
|
The SO question doesn't apply to this issue. The SO question deals with the difference in behaviour between The issue I'm reporting deals with the difference in behaviour of |
|
The SO answer points to the issue: when you specify |
|
|
|
One more piece of information to support that |
|
@trevnorris @chrisdickinson ... any further thoughts on this? |
|
sorry. nope. |
|
@n-riesco ... I definitely agree that it's irritating and confusing. A quick test shows the same behavior in io.js. Technically, it's not a bug but it's not optimal by any means. I'll keep this open but I'm going to tag this as a defer to the converged stream. Since it involves a change in existing implemented behavior, it likely would need to land in either io.js or the converged repo. @joyent/node-tsc ... do any of you have any additional thoughts? |
|
@jasnell Thanks for taking care of this issue. Whatever the final decision is, please, consider I'm making use of the current behaviour of |
|
I would argue that this is working as designed.
If there was an easy way to put closure scope free vars and declared vars, then it would surely be a useful thing to have on the vm module. But it would need to be a different name, or else this would introduce a very subtle breaking change that is probably not worth the hazard. I recommend closing this issue if the TSC doesn't decide it's worth putting on the roadmap. |
|
If there is a "bug" here, imo, it's that this does work in |
|
@isaacs Just to be clear, you are arguing that a script using var vm = require("vm");
console.log("global:", vm.runInThisContext("global instanceof Object"));
console.log("require:", vm.runInThisContext("require instanceof Object"));whereas a script using console.log("global:", eval("global instanceof Object"));
console.log("require:", eval("require instanceof Object"));An argument against removing My current thought is that function runInThisContext(code) {
return eval(code);
} |
|
In all honesty The two cases of @domenic Is this how it's supposed to work? |
|
Yeah, it is. @isaacs's explanation is helpful. It's actually really important for security that require not be exposed. If you want to expose it, then you do. But we can't suddenly give all that formerly-sandboxed code access to If you want Anyway, I agree it's confusingly named. The word "context" here means "V8 context" not e.g. "ES execution context" (~= function scope). |
"Node.js virtual machine" is a nonsensical term. There is only one VM in your program: the V8 VM. That is what the vm module is representing. |
|
On 25/08/15 19:07, Domenic Denicola wrote:
One could argue that to prevent access to
My experience is that this "confusion"/"expectation" is very common amongst users of |
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, nodejs#4955 PR-URL: nodejs#5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
runInThisContext is missing
requireonly when running a javascript file. I think the following commands explain better what I mean:I see the same behaviour is also present in v0.11.15.
And I've just checked it is also present on the official docker images for v0.10 and v0.12:
The text was updated successfully, but these errors were encountered: