如何使用 VM 在 nodejs 中安全地运行用户代码而不会受到攻击

Question

I'm making a nodejs project, and I want to be able to run user code safely using the vm module, but there's many vulnerabilities such as the constructor of every object/function to be used to eval js string. any way to secure it? Thanks!

I tried everything, but nothing works. I also don't want to use other packages. Thanks.

Answer 1

There doesn't seem to be any built-in method to run untrusted code safely. I suppose if you could work with external libraries, there are a few solutions dedicated to this purpose like isolated-vm and vm2 .