Question

I’m building a node server that needs to execute code that might be unsafe. In order to achieve this I’m using a Sandbox API that blocks attacks and returns the result and output from a script. It uses a modified global object to keep access hidden from the Node global object (and the use of require… etc).

My specific need right now is to take an object that is defined by a user (this is all trusted, nothing from random users on the internet so security isn’t the biggest concern at the moment, right now it’s to get it working) and create a dynamic bit of code that will “transfer” the object along with their code to a child Node process for safe execution (the security here is so that any errors don’t crash the main process).

My current goal is to take an object, like the following:

obj = {
  defaultName: "Unnamed",
  hello: function(name) {
    if (typeof name === "undefined" || name === null)
      name = this.defaultName;
    echo("Hello, " + name + "!");
  }
}

(This is very simplistic, it’s for testing)

I’m using FJSON to serialize the functions for transfer as well. My attempt at serializing this for transfer with the code is as follows:

// "code" is the users code
// "obj" is the object above
// "Extend" is a function defined by the Child process
var str = FJSON.funkify(obj);
code = "var temp = FJSON.unfunkify(\"" + str + "\"); Extend(this, temp); temp = undefined; " + code;

After doing this, and attempting to write it to the child I get weird (and cryptic errors) like: “Unexpected token {” or (rarely and more cryptic) “Unexpected token ILLEGAL ‘” (which, this is confusing because I’ve verified that nowhere in the code am I inserting a ' and there are none in the test code).

The funkified string is {"defaultName": "Unnamed","hello":{"FUNCTION":true,"params":["name"],"body":"\n\r if (typeof name === \"undefined\" || name === null)\n\r name = this.defaultName;\n\r echo(\"Hello, \" + name + \"!\");\n\r "}}

And finally, for the sake of testing, I’ve tried serializing a simple object (without functions using JSON, and with functions using FJSON) and then attempting to run eval on the string in the Node REPL but I keep getting ... when I try eval(JSON.stringify(objWithoutFunctions)); and the same with the FJSON.

I’ve struggled with this problem for several hours now and can’t think of any other things to try/check. Any suggestions are appreciated.

UPDATE

I still have been unable to determine the most efficient way to do this, as stringifying the object and transferring it along with code was not working and I was unable to get it to work nicely I’ve reverted to converting the object into code, essentially looping through the properties and assigning the variables manually. To provide example:

The object:

obj = {
  prop: "ItsValue",
  otherProp: true
};

Would become:

this.prop = "ItsValue"; this.otherProp = true;

Answer 1

I found a workaround as listed in the Update, I just converted the object into code. It could have been issues with the FJSON library which I’ve fixed since then. This is no longer an issue but I still welcome any answers that may be able to address the original problem.