dockerscript icon indicating copy to clipboard operation
dockerscript copied to clipboard

Use of sandboxed-module breaks asynchronous code.

Open tolmasky opened this issue 8 years ago • 7 comments

If you have code like this:

var t = require("./x");

setTimeout(function()
{
    console.log(t === require("./x"));
}, 1000);

The second require appears to be not sandboxed while the first is. Not sure, but they are certainly different and this results false.

tolmasky avatar Feb 17 '17 20:02 tolmasky

Changing singleOnly to false seems to resolve this issue.

tolmasky avatar Feb 17 '17 20:02 tolmasky

I think that was a concession to make babel work. Babel probably isn't necessary for this anymore. PR?

summer4096 avatar Feb 17 '17 20:02 summer4096

Just to clarify, would you like me to just change singleOnly to false, or also remove babel?

tolmasky avatar Feb 17 '17 20:02 tolmasky

Both. If singleOnly is false but babel is still in, it'll be transpiling every module you require, which might end up being very bad.

summer4096 avatar Feb 17 '17 20:02 summer4096

As a question, why is sandboxed-module used at all? Is there an actual thing being protected against? In my experiments it is very difficult to get it to behave correctly using it at all, but if I just require the file it's fine.

tolmasky avatar Feb 21 '17 01:02 tolmasky

The whole idea was to allow template tag syntax before it was supported in node. Using sandboxed-module allowed that through babel, but now that node supports it, there isn't much reason to keep using either sandboxed-module or babel. I'm not exactly sure how to pull it out but, if you can, go for it.

summer4096 avatar Feb 21 '17 14:02 summer4096

OK, I've removed it. Again, I bumped up the version since it's a breaking change, but not sure how to handle that.

tolmasky avatar Feb 21 '17 23:02 tolmasky