patriksimek/vm2

Features

• Isolated Code Execution - Provides a secure environment for executing untrusted third-party JavaScript code while protecting the host Node.js process.
• Node.js Sandboxing - Protects the host Node.js process from malicious scripts by limiting memory, execution time, and global object access.
• Runtime Virtualizers - Acts as a runtime virtualizer that protects the host global context through object proxying and property freezing.
• Script Execution Timeouts - Implements watchdog mechanisms to terminate embedded scripts that exceed a specified execution time limit.
• Buffer Memory Caps - Caps the size of memory allocation requests for buffers to prevent malicious scripts from causing memory exhaustion.
• Sandbox Module Loader Emulators - Mimics a standard module loader to provide configurable control over which external dependencies are accessible to sandboxed code.
• Dynamic Script Execution - Evaluates and runs JavaScript source code or precompiled scripts within a controlled context at runtime.
• Module Access Control - Filters requested Node.js modules through a predefined allow-list of names and paths before loading.
• Object Protections - Restricts the ability of sandboxed scripts to attach new functions to objects, preventing prototype pollution and unauthorized modifications.
• Proxy Objects - Wraps host objects in proxies to intercept property access and prevent unauthorized mutations or leaks.
• Sandboxed JavaScript Execution - Provides an isolated execution environment for running untrusted JavaScript code with restricted Node.js runtime access.
• Module Access Restrictions - Prevents untrusted scripts from importing unauthorized or protected Node.js modules via access restrictions.
• Filesystem Access Restrictions - Provides mechanisms to restrict sandboxed code to specific directories or file paths to prevent unauthorized disk access.
• Buffer Allocation Limits - Provides mechanisms to cap the size of individual memory allocation requests for buffers to prevent resource exhaustion.
• Object Freezing - Recursively freezes shared objects to ensure they are read-only and prevent sandboxed scripts from modifying host state.
• Object Sealing and Freezing - Implements object sealing and freezing to make proxied objects read-only, preventing property modification or deletion.
• Module Loading Filters - Restricts which built-in and external Node.js modules can be imported using strict allow-lists.
• Sandbox Resource Caps - Enforces execution timeouts and memory ceilings to protect the host system from denial-of-service attacks by untrusted scripts.
• Execution Resource Limiters - Sets memory limits and execution timeouts to protect the host process from resource exhaustion and DoS attacks.
• Runtime Context Isolation - Creates isolated execution environments by managing distinct global objects and heaps for each script run.
• Compiled Script Caches - Caches pre-compiled script representations to accelerate repeated execution and reduce redundant processing.
• Canonical Path Resolution - Implements canonical path resolution to ensure file paths are absolute and unique, preventing directory traversal attacks.
• Ahead-Of-Time Compilation - Implements ahead-of-time compilation of source code into a cached binary format to reduce repeated execution overhead.
• Context-Isolated Invocations - Provides a secure way to call functions inside the sandbox by cloning arguments to protect the host global context.
• Inter-Sandbox Communication - Allows secure data exchange and callback invocation between multiple isolated sandbox environments.
• Secure Code Evaluators - Executes scripts with strict memory and execution time limits to prevent denial-of-service attacks on the host.
• Sandboxing - Advanced virtual machine/sandbox for Node.js.

Star history