Advantages over the native VM module

[odino]

Advantages over the native VM module

[patriksimek]

You can try it yourself:

const vm = require('vm');
vm.runInNewContext('this.constructor.constructor("return process")().exit()');
console.log('Never gets executed.');

vs

const {VM} = require('vm2');
new VM().run('this.constructor.constructor("return process")().exit()');

[patriksimek]

The vm2 library doesn't fix anything, it uses internal VM as is. The reason to use vm2 is to execute a code and prevent it to access things outside the VM context.

[odino]

Though would it be the same of just running vm.runInNewContext(code, ctx) where ctx is a user defined sandbox? I kind of fail to see how this library would help more than the VM module already does.

…

On Mar 2, 2017 10:38 PM, "Patrik Simek" ***@***.***> wrote: The vm2 library doesn't fix anything, it uses internal VM as is. The reason to use vm2 is to execute a code and prevent it to access things outside the VM context. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#59 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAUC5Lgs0WWq14ps-7u2CMFfCoxISmukks5rhyjdgaJpZM4MRFcW> .

[odino]

Ouch :( that's nasty!

Thanks for updating the readme.