eight04/node_vm2

A Python 3 to Node.js + vm2 binding, helps you execute JavaScript safely.

node_vm2

Warning

This project is no longer maintained. Please use deno_vm instead.

A Python 3 to Node.js + vm2 binding, helps you execute JavaScript safely.

vm2

vm2 is a node module to create real sandbox in node. The official node API vm, can only create isolate context and doesn't prevent harmful code to damage your computer.

How it works

The module launchs a Node.js REPL server, which can be communicated with JSON. All JavaScript code are encoded in JSON and sent to the server. After the server executing the code in vm2, the result is sent back to Python.

Install

You need Node.js.

https://nodejs.org/

Install node_vm2 from pypi wheel.

pip install node_vm2

Also make sure you have node executable in PATH, or you can specify the executable with environment variable NODE_EXECUTABLE.

Additionally, you will need npm to build node_vm2 from source.

Usage

Most of the APIs are bound to vm2.

Simple eval:

from node_vm2 import eval

print(eval("['foo', 'bar'].join()"))

Use VM:

from node_vm2 import VM

with VM() as vm:
   vm.run("""
      var sum = 0, i;
      for (i = 0; i < 10; i++) sum += i;
   """)
   print(vm.run("sum"))

Use NodeVM:

from node_vm2 import NodeVM

js = """exports.greet = name => console.log(`Hello ${name}!`);"""

with NodeVM.code(js) as module:
   module.call_member("greet", "John")

It is possible to do async task with Promise:

from datetime import datetime
from node_vm2 import NodeVM

js = """
exports.test = () => {
   return new Promise(resolve => {
      setTimeout(() => {
         resolve("hello")
      }, 3000);
   });
};
"""
with NodeVM.code(js) as module:
   print(datetime.now())
   print(module.call_member("test"))
   print(datetime.now())

If you like to allow the VM to crash your server (e.g. process.exit()), you should create the VM in a separate server so it won't affect other VMs:

from node_vm2 import VMServer, VM

with VMServer() as server:
   with VM(server=server) as vm:
      # now the vm is created in a new server
      print(vm.run("1 + 2 + 3"))

API reference

http://node-vm2.readthedocs.io/

Changelog

• 0.4.6 (Oct 23, 2023)
  • Change: add deprecation warning.
  • Update vm2 to 3.9.19.
• 0.4.5 (Sep 1, 2022)
  • Update vm2 to 3.9.11.
• 0.4.4 (Mar 14, 2022)
  • Update vm2 to 3.9.9.
• 0.4.3 (Feb 15, 2022)
  • Update vm2 to 3.9.7.
• 0.4.2 (Feb 9, 2022)
  • Update vm2 to 3.9.6.
  • Fix: filename is optional.
• 0.4.1 (Oct 20, 2021)
  • Update vm2 to 3.9.5.
• 0.4.0 (Sep 2, 2021)
  • Update vm2 to 3.9.3.
  • Change: throw VMError when failed running node.
• 0.3.7 (Mar 23, 2020)
  • Update vm2 to 3.9.0.
• 0.3.6 (Apr 22, 2019)
  • Update vm2 to 3.8.0. Fix security issues.
• 0.3.5 (Feb 10, 2019)
  • Update vm2 to 3.6.10. Fix security issues.
• 0.3.4 (Aug 10, 2018)
  • Update vm2 to 3.6.3. Fix security issues.
• 0.3.3 (Jul 23, 2018)
  • Fix: don't bundle dev dependencies.
• 0.3.2 (Jul 23, 2018)
  • Fix: getting a freezed object would crash the server.
  • Update vm2 to 3.6.2. Fix security issues.
• 0.3.1 (Apr 25, 2017)
  • Add command arg to VMServer.
  • Fix: A dead default server is created if process spawning failed.
• 0.3.0 (Apr 23, 2017)
  • Change: use event queue to handle console redirects.
  • Reconize object thrown by VM which doesn't inherit built-in Error.
• 0.2.0 (Mar 25, 2017)
  • Drop NodeBridge.
  • Add VMServer.
  • Make all VMs share a default VMServer.
  • Method rename: VM.connect -> VM.create, VM.close -> VM.destroy.
• 0.1.0 (Mar 23, 2017)
  • First release

node_vm2's Issues

Sandbox option not working as expected

I may have misunderstood how this is supposed to work, but I believe that if I add an object to the sandbox option, it should be available as a global when the code executes in the VM.

My test code is here:

    with node_vm2.VMServer() as server:
        with node_vm2.VM(
            server=server,
            options={
                "timeout": 500,
                "allowAsync": False,
                "wasm": False,
                "sandbox": {"input": json.loads('{"data": {"foo": "bar"}}')},
            },
        ) as vm:
            print(vm.run("input.data.foo"))

I would expect input to be available, but instead I get the error "input is not defined".

Is this not working correctly, or have I misunderstood how this should be used?

How do I import the node module using require?

Like this

NodeVM not working correctly

I am expecting the module.get_member() function to get variable from the vm.code() result.
But everytime It returns just None.

from node_vm2 import NodeVM, VMServer, VM

vm_option = {
    'console': 'inherit',
    'sandbox': [
    ],
    'require': {
        'external': [],
        'builtin': [],
        'import': [],
        'root': "./",
        'mock': { }
    }
}

with VMServer() as server:
    with NodeVM(server=server, **vm_option) as vm:
        with vm.code("var abc = 'aa';") as module:
            print(module.get_member('abc'))

print(module.get_member('abc')) just shows None.

better error message when node is not installed

eight04/ComicCrawler#313

Support changing context at runtime

I would like to request a feature that allows changing the context of a NodeVM at runtime. For example, I want to be able to pass a Python function to the NodeVM and call it from JavaScript. Here is a sample code that demonstrates what I want to achieve:

from node_vm2 import NodeVM
def test():
print(666)
return 777
js = """exports.greet = function(){return test()}"""
with NodeVM.code(js) as module:
module.test=test
print(module.call_member('greet'))

This code should print 666 and 777, but it raises an exception: node_vm2.VMError: test is not defined

I think this feature would be useful for many scenarios where the Python and JavaScript code need to interact with each other dynamically. It would also make the NodeVM more flexible and powerful.

Is there any way to implement this feature? Or is there any workaround to achieve the same effect? Thank you for your attention and your great work on node_vm2.

Update vm2 to 3.6.3.

patriksimek/vm2#144

Using built-in module

Hello,
I'm interesting this project for using python chatbot. And, very thanks porting to python.
https://github.com/patriksimek/vm2#quick-example
partiksimek's vm2 support node's built-in require module with options.

I trying this feature. but, can't using built-in require module. How I can this?

Code

with VM(timeout=2000, require='{external:true'}) as vm:
    vm.run(recv_message)

Result

require is not defined

Thanks.

JSON.stringify the result may generate error

node_vm2/node_vm2/vm-server/index.js

Line 35 in 69ddd86

console.log(JSON.stringify(result));

d:\dev\node_vm2\node_vm2\vm-server\index.js:35
                console.log(JSON.stringify(result));
                                 ^

TypeError: 'getOwnPropertyDescriptor' on proxy: trap returned descriptor for pro
perty 'userData' that is incompatible with the existing property in the proxy ta
rget
    at JSON.stringify (<anonymous>)
    at Interface.rl.on.line (d:\dev\node_vm2\node_vm2\vm-server\index.js:35:20)
    at Interface.emit (events.js:127:13)
    at Interface._onLine (readline.js:285:10)
    at Interface._normalWrite (readline.js:433:12)
    at Socket.ondata (readline.js:144:10)
    at Socket.emit (events.js:127:13)
    at addChunk (_stream_readable.js:269:12)
    at readableAddChunk (_stream_readable.js:256:11)
    at Socket.Readable.push (_stream_readable.js:213:10)

Ref: patriksimek/vm2#136

Update vm2

patriksimek/vm2#138

How do I import the node module using require

How do I import the node module using require

The used version of vm2 is vulnerable

https://github.com/eight04/node_vm2/blob/master/node_vm2/vm-server/package-lock.json#L1252

See: https://security.snyk.io/vuln/SNYK-JS-VM2-5537100

Thanks to updating it and creating a new release :-)