compiler-util

compiler-util copied to clipboard

Sandbox escape possibility (`this`)

1

With the default setup it is easily possible to escape the sandbox: ``` const compiler = require('@nx-js/compiler-util') compiler.compileCode('return this')({}) // returns Object [global] ``` There is a way to protect...

ghost

Vulnerability

14

You can escape the sandbox using something like this: ``` const compiler = require('@nx-js/compiler-util'); const code = compiler.compileCode('} { return global.process.env.LOGNAME'); const user = code({}); console.log(user); ```

saltimbanc

Thanks for sharing this library! Reading through the code it seems like that user code is run on the main thread, right? Any known issues or recommendations about Running it...

natarius

Add a list of contributors to the project.

solkimicreb

Library doesn't work with ESBuild -> Uncaught Error: Dynamic require of "@nx-js/compiler-util" is not supported

1

Since the library has to be imported with "require", I encounter the same issue as here: https://github.com/evanw/esbuild/issues/1921 `Uncaught Error: Dynamic require of "@nx-js/compiler-util" is not supported` Can this library published...

mirobo