Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More →
Socket
Sign inDemoInstall
Socket
Sign inDemoInstall

vm2

Package Overview
Dependencies
Maintainers
3
Versions
65
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

vm2 - npm Package Compare versions

Comparing version 3.9.2 to 3.9.3

2

index.d.ts

@@ -69,3 +69,3 @@ import {EventEmitter} from 'events';

console?: "inherit" | "redirect" | "off";
/** `true` or an object to enable `require` optionss (default: `false`). */
/** `true` or an object to enable `require` options (default: `false`). */
require?: true | VMRequire;

@@ -72,0 +72,0 @@ /** `true` to enable VMs nesting (default: `false`). */

44

lib/contextify.js

@@ -14,3 +14,3 @@ /* global host */

local.Reflect.ownKeys = Reflect.ownKeys;
local.Reflect.enumerable = Reflect.enumerate;
local.Reflect.enumerate = Reflect.enumerate;
local.Reflect.getPrototypeOf = Reflect.getPrototypeOf;

@@ -149,4 +149,4 @@ local.Reflect.construct = Reflect.construct;

configurable: true,
enumberable: desc.enumberable,
writeable: true,
enumerable: desc.enumerable,
writable: true,
value: null

@@ -178,3 +178,3 @@ };

} catch (e) {
// Never pass the handled expcetion through!
// Never pass the handled exception through!
return new host.Array();

@@ -196,3 +196,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -254,3 +254,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -289,3 +289,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -350,3 +350,3 @@ }

def = host.Object.getOwnPropertyDescriptor(target, prop);
if (!def || def.configurable) {
if (!def || def.configurable || def.writable !== desc.writable) {
local.Reflect.defineProperty(target, prop, desc);

@@ -369,3 +369,3 @@ }

// There's a chance accessing a property throws an error so we must not access them
// in try catch to prevent contextyfing local objects.
// in try catch to prevent contextifying local objects.

@@ -390,3 +390,3 @@ const propertyDescriptor = host.Object.create(null);

}
if (success && descriptor.configurable) {
if (success && !descriptor.configurable) {
try {

@@ -541,3 +541,4 @@ local.Reflect.defineProperty(target, key, descriptor);

} else if (instanceOf(value, WeakSet)) { return Decontextify.instance(value, host.WeakSet, deepTraps, flags, 'WeakSet');
} else if (Promise && instanceOf(value, Promise)) { return Decontextify.instance(value, host.Promise, deepTraps, flags, 'Promise');
} else if (typeof Promise === 'function' && instanceOf(value, Promise)) {
return Decontextify.instance(value, host.Promise, deepTraps, flags, 'Promise');
} else if (local.Reflect.getPrototypeOf(value) === null) {

@@ -558,3 +559,3 @@ return Decontextify.instance(value, null, deepTraps, flags);

} catch (ex) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -579,3 +580,3 @@ }

} catch (e) {
// Never pass the handled expcetion through!
// Never pass the handled exception through!
return new local.Array();

@@ -597,3 +598,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -660,3 +661,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -697,3 +698,3 @@ }

} catch (e) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -761,3 +762,3 @@ }

def = host.Object.getOwnPropertyDescriptor(target, prop);
if (!def || def.configurable) {
if (!def || def.configurable || def.writable !== desc.writable) {
local.Reflect.defineProperty(target, prop, desc);

@@ -780,3 +781,3 @@ }

// There's a chance accessing a property throws an error so we must not access them
// in try catch to prevent contextyfing local objects.
// in try catch to prevent contextifying local objects.

@@ -809,3 +810,3 @@ const descGet = descriptor.get;

}
if (success && descriptor.configurable) {
if (success && !descriptor.configurable) {
try {

@@ -928,3 +929,4 @@ local.Reflect.defineProperty(target, key, descriptor);

} else if (instanceOf(value, host.WeakSet)) { return Contextify.instance(value, WeakSet, deepTraps, flags, 'WeakSet');
} else if (instanceOf(value, host.Promise)) { return Contextify.instance(value, Promise, deepTraps, flags, 'Promise');
} else if (typeof Promise === 'function' && instanceOf(value, host.Promise)) {
return Contextify.instance(value, Promise, deepTraps, flags, 'Promise');
} else if (instanceOf(value, host.Buffer)) { return Contextify.instance(value, LocalBuffer, deepTraps, flags, 'Uint8Array');

@@ -946,3 +948,3 @@ } else if (host.Reflect.getPrototypeOf(value) === null) {

} catch (ex) {
// Never pass the handled expcetion through! This block can't throw an exception under normal conditions.
// Never pass the handled exception through! This block can't throw an exception under normal conditions.
return null;

@@ -949,0 +951,0 @@ }

76

lib/main.js

@@ -29,2 +29,7 @@ /* eslint-disable global-require, no-use-before-define */

const helpers = require('./helpers.js');
const importModuleDynamically = () => {
// We can't throw an error object here because since vm.Script doesn't store a context, we can't properly contextify that error object.
// eslint-disable-next-line no-throw-literal
throw 'Dynamic imports are not allowed.';
};

@@ -44,3 +49,4 @@ /**

filename,
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -82,3 +88,3 @@ }

*/
const DEFAULT_RUN_OPTIONS = {displayErrors: false};
const DEFAULT_RUN_OPTIONS = {displayErrors: false, importModuleDynamically};

@@ -117,3 +123,3 @@ /**

function jsCompiler(code, filename) {
return code;
return removeShebang(code);
}

@@ -148,2 +154,14 @@

/**
* Remove the shebang from source code.
*
* @private
* @param {string} code - Code from which to remove the shebang.
* @return {string} code without the shebang.
*/
function removeShebang(code) {
if (!code.startsWith('#!')) return code;
return '//' + code.substr(2);
}
/**
* Class Script

@@ -310,2 +328,3 @@ *

this._compiledNodeVM = null;
this._compiledCode = null;
},

@@ -350,2 +369,6 @@ enumerable: true

},
_compiledCode: {
value: null,
writable: true
},
_compiler: {value: resolvedCompiler}

@@ -392,2 +415,15 @@ });

/**
* Get the compiled code.
*
* @private
* @return {string} The code.
*/
getCompiledCode() {
if (!this._compiledCode) {
this._compiledCode = this._compiler(this._prefix + removeShebang(this._code) + this._suffix, this.filename);
}
return this._compiledCode;
}
/**
* Compiles this script to a vm.Script.

@@ -402,7 +438,8 @@ *

_compile(prefix, suffix) {
return new vm.Script(prefix + this._compiler(this._prefix + this._code + this._suffix, this.filename) + suffix, {
return new vm.Script(prefix + this.getCompiledCode() + suffix, {
filename: this.filename,
displayErrors: false,
lineOffset: this.lineOffset,
columnOffset: this.columnOffset
columnOffset: this.columnOffset,
importModuleDynamically
});

@@ -471,3 +508,4 @@ }

filename: 'timeout_bridge.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -479,2 +517,3 @@ }

displayErrors: false,
importModuleDynamically,
timeout

@@ -491,3 +530,3 @@ });

* @private
* @param {*} internal - The interal vm object.
* @param {*} internal - The internal vm object.
* @return {*} The hook function

@@ -682,3 +721,4 @@ */

filename: 'get_global.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -688,3 +728,4 @@ try {

filename: 'get_generator_function.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -695,3 +736,4 @@ } catch (ex) {}

filename: 'get_async_function.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -702,3 +744,4 @@ } catch (ex) {}

filename: 'get_async_generator_function.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -830,3 +873,3 @@ } catch (ex) {}

if (this._hook) {
const scriptCode = code.code;
const scriptCode = code.getCompiledCode();
const changed = this._hook('run', [scriptCode])[0];

@@ -838,3 +881,4 @@ if (changed === scriptCode) {

filename: code.filename,
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -854,3 +898,4 @@ }

filename: useFileName,
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -1130,3 +1175,4 @@ }

filename: unresolvedFilename,
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -1133,0 +1179,0 @@ }

13

lib/sandbox.js

@@ -12,2 +12,7 @@ /* eslint-disable no-shadow, no-invalid-this */

const parseJSON = JSON.parse;
const importModuleDynamically = () => {
// We can't throw an error object here because since vm.Script doesn't store a context, we can't properly contextify that error object.
// eslint-disable-next-line no-throw-literal
throw 'Dynamic imports are not allowed.';
};

@@ -71,3 +76,4 @@ /**

filename: filename || 'vm.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -82,3 +88,4 @@

filename: filename || 'vm.js',
displayErrors: false
displayErrors: false,
importModuleDynamically
});

@@ -672,3 +679,3 @@

/*
Return contextized require.
Return contextified require.
*/

@@ -675,0 +682,0 @@

2

package.json

@@ -16,3 +16,3 @@ {

],
"version": "3.9.2",
"version": "3.9.3",
"main": "index.js",

@@ -19,0 +19,0 @@ "repository": "github:patriksimek/vm2",

9

README.md

@@ -193,3 +193,3 @@ # vm2 [![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Package Quality][quality-image]][quality-url] [![Travis CI][travis-image]][travis-url] [![Known Vulnerabilities][snyk-image]][snyk-url]

To load modules by relative path, you must pass full path of the script you're running as a second argument of vm's `run` method. Filename then also shows up in any stack traces produced from the script.
To load modules by relative path, you must pass full path of the script you're running as a second argument of vm's `run` method if the script is a string. Filename then also shows up in any stack traces produced from the script.

@@ -200,2 +200,9 @@ ```javascript

If the script you are running is an VMScript, the path is given in the VMScript constructor.
```javascript
const script = new VMScript("require('foobar')", {filename: "/data/myvmscript.js"});
vm.run(script);
```
## VMScript

@@ -202,0 +209,0 @@

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

About

Packages

npm

Go

Maven

PyPI

Rubygems

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc