這次帶給大家Node.js 沙箱環境使用步驟詳解，Node.js 沙箱環境使用的注意事項有哪些，下面就是實戰案例，一起來看一下。
node官方文件裡提到node的vm模組可以用來做沙箱環境執行程式碼，對程式碼的上下文環境做隔離。
#先看一個例子\A common use case is to run the code in a sandboxed environment. The sandboxed code uses a different V8 Context, meaning that it has a different global object than the Context, meaning that it has a different global object than the rest of the .
const vm = require('vm');
let a = 1;
var result = vm.runInNewContext('var b = 2; a = 3; a + b;', {a});
console.log(result); // 5
console.log(a); // 1
console.log(typeof b); // undefinedconst vm = require('vm');
let a = 1;
var result = vm.runInNewContext('var b = 2; a = 3; return a + b;', {a});
console.log(result);
console.log(a);
console.log(typeof b);evalmachine.<anonymous>:1 var b = 2; a = 3; return a + b; ^^^^^^ SyntaxError: Illegal return statement at new Script (vm.js:74:7) at createScript (vm.js:246:10) at Object.runInNewContext (vm.js:291:10) at Object.<anonymous> (/Users/xiji/workspace/learn/script.js:3:17) at Module._compile (internal/modules/cjs/loader.js:678:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:689:10) at Module.load (internal/modules/cjs/loader.js:589:32) at tryModuleLoad (internal/modules/cjs/loader.js:528:12) at Function.Module._load (internal/modules/cjs/loader.js:520:3) at Function.Module.runMain (internal/modules/cjs/loader.js:719:10)
const vm = require('vm');
let localVar = 'initial value';
const vmResult = vm.runInThisContext('localVar += "vm";');
console.log('vmResult:', vmResult);
console.log('localVar:', localVar);
console.log(global.localVar);evalmachine.<anonymous>:1 localVar += "vm"; ^ ReferenceError: localVar is not defined at evalmachine.<anonymous>:1:1 at Script.runInThisContext (vm.js:91:20) at Object.runInThisContext (vm.js:298:38) at Object.<anonymous> (/Users/xiji/workspace/learn/script.js:3:21) at Module._compile (internal/modules/cjs/loader.js:678:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:689:10) at Module.load (internal/modules/cjs/loader.js:589:32) at tryModuleLoad (internal/modules/cjs/loader.js:528:12) at Function.Module._load (internal/modules/cjs/loader.js:520:3) at Function.Module.runMain (internal/modules/cjs/loader.js:719:10)
const vm = require('vm');
let localVar = 'initial value';
const vmResult = vm.runInThisContext('localVar = "vm";');
console.log('vmResult:', vmResult); // vm
console.log('localVar:', localVar); // initial value
console.log(global.localVar); // vmconst vm = require('vm');
let localVar = 'initial value';
const vmResult = vm.runInNewContext('localVar = "vm";');
console.log('vmResult:', vmResult); // vm
console.log('localVar:', localVar); // initial value
console.log(global.localVar); // undefined逾時控制及錯誤擷取
vm針對要執行的程式碼提供了逾時機制，透過指定timeout參數即可以runInThisContext為例const vm = require('vm');
let localVar = 'initial value';
const vmResult = vm.runInThisContext('while(true) { 1 }; localVar = "vm";', { timeout: 1000});vm.js:91 return super.runInThisContext(...args); ^ Error: Script execution timed out. at Script.runInThisContext (vm.js:91:20) at Object.runInThisContext (vm.js:298:38) at Object.<anonymous> (/Users/xiji/workspace/learn/script.js:3:21) at Module._compile (internal/modules/cjs/loader.js:678:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:689:10) at Module.load (internal/modules/cjs/loader.js:589:32) at tryModuleLoad (internal/modules/cjs/loader.js:528:12) at Function.Module._load (internal/modules/cjs/loader.js:520:3) at Function.Module.runMain (internal/modules/cjs/loader.js:719:10) at startup (internal/bootstrap/node.js:228:19)
const vm = require('vm');
let localVar = 'initial value';
try {
const vmResult = vm.runInThisContext('while(true) { 1 }; localVar = "vm";', {
timeout: 1000
});
} catch(e) {
console.error('executed code timeout');
}#延遲執行
#vm除了即時執行程式碼之外，也可以先編譯然後過一段時間再執行，這就需要提到vm.Script了。其實無論是runInNewContext、runInThisContext還是runInThisContext，背後其實都創建了Script，從之前的報錯信息就可以看出來接下來我們就用vm.Script來重寫本文開頭的例子const vm = require('vm');
let a = 1;
var script = new vm.Script('var b = 2; a = 3; a + b;');
setTimeout(() => {
let result = script.runInNewContext({a});
console.log(result); // 5
console.log(a); // 1
console.log(typeof b); // undefined
}, 300);node --experimental-vm-module index.js
#vm作為沙箱環境安全性嗎？
vm相對於eval來說更安全一些，因為它隔離了當前的上下文環境了，但儘管如此依然可以存取標準的JS API和全域的NodeJS環境，因此vm並不安全，這個在官方文檔裡就提到了The vm module is not a security mechanism. Do not use it to run untrusted code請看下面的例子
const vm = require('vm');
vm.runInNewContext("this.constructor.constructor('return process')().exit()")
console.log("The app goes on...") // 永远不会输出let ctx = Object.create(null);
ctx.a = 1; // ctx上不能包含引用类型的属性
vm.runInNewContext("this.constructor.constructor('return process')().exit()", ctx);const {VM} = require('vm2');
new VM().run('this.constructor.constructor("return process")().exit()');const { VM } = require('vm2');
const vm = new VM({ timeout: 1000, sandbox: {}});
vm.run('new Promise(()=>{})');const { VM } = require('vm2');
const vm = new VM({
timeout: 1000, sandbox: { Promise: function(){}}
});
vm.run('Promise = (async function(){})().constructor;new Promise(()=>{});');Vue專案webpack打包部署時Tomcat刷新封包404錯誤問題如何處#理
以上是Node.js 沙箱環境使用步驟詳解的詳細內容。更多資訊請關注PHP中文網其他相關文章！
