Question

I’m building an MMO using Node.js, and I’d like some scripters from my team to create scripts (duh) for bosses and other scripted objects. My first thought was to have a folder on the server where people can upload javascript files and let node.js automatically read and parse every script in the directory, but I don’t want them to be able to execute process.exit() for example, or other hazardous stuff.

Is there a solution that lets me control what functions the scripters are able to call?

Answer 1

You can control what functions are they unable to call with vm module.

For example,

vm.runInNewContext(userCode, {
    require: null,
    process: null,
    someFunc: function (x) { return x+1 },
    someData: { abc: 'def' }
});