Skip to content

Conversation

@eljefedelrodeodeljefe
Copy link
Contributor

As user in order to run node code in a vm, you would need to apply some objects to it. This is not quite well documented and may or may not have been reason for a series of issues and SO questions.

This PR would add an example to explain this. It is to some extent controversial and was discussed in a code PR #4955. Issue would have been nodejs/node-v0.x-archive#9211 and this link to SO.

An easier solution would be to use eval(), which I regard as an anti-pattern.
Also it uses require('module').wrap(code), which I believe to be a "private" API. I have taken and modified this example from the referenced issues.

/cc @nodejs/documentation

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

module is private

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make valuable comments that bring the discussion forth not back. Any other way then than this and eval?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

vm.runInThisContext(`(function(require){ require('http')})`)(require)

@eljefedelrodeodeljefe
Copy link
ContributorAuthor

Force pushed this. Doesn't look pretty but solves the problem.

@mscdexmscdex added doc Issues and PRs related to the documentations. vm Issues and PRs related to the vm subsystem. labels Feb 19, 2016
@Knighton910
Copy link

👍 @eljefedelrodeodeljefe

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor nit... having the let code = on a separate line with no indenting on the next line makes it a bit confusing.

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agree. fixed and force pushed. Thx.

@jasnell
Copy link
Member

LGTM

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should either not be a heading, or a 3rd level heading.

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we are using the heading style when it is an example, outside of a method, but rather a guide or such. E.g. here https://github.com/nodejs/node/blob/master/doc/api/readline.markdown#example-tiny-cli . If you'd rather want it belonging to .runInThisContext(), I can do it w/o pounds.

Having a look at for example streams, it would be 3rd level, but because it's having 2nd level topics like Writable etc. We are a little inconsistent about this I fear. :(

No strong opinions though.

@eljefedelrodeodeljefe
Copy link
ContributorAuthor

@jasnell agree. Changed it to what you provided.

Also added this issue, for potential harmonization of pronouns nodejs/docs#87

@Qard
Copy link
Member

Qard commented Mar 7, 2016

Not sure how I feel about documenting this in this way. Normally the vm functions are meant to provide a sandboxed context and this is doing the opposite. The problem I see here is that it's not immediately clear that require is not just a stateless function. Using require will stuff modules into the cache globally, and you could do some nefarious things, like mess with the contents of require.cache. If we do want to document this, I think we need to be very clear about the risks involved.

As a side note: I'd only really consider eval() to be an anti-pattern when used on user-supplied code. In a controlled environment, I'd consider it at worst to be a possible deoptimization trigger. It's not actually that bad, if you are careful.

@eljefedelrodeodeljefe
Copy link
ContributorAuthor

I'd wish for the API to be a little less confusing, but it is what is and at least it allows for some configuration. Also I wouldn't use eval() because you can't directly return from it. The use case I found for it is in a child_process - possibly - on a remote system. The layer of security then would be to share explicitly share resources between parent and child or not.

Documenting dangers would be fine of course. Maybe also hinting to the use case above.

@jasnell
Copy link
Member

@Qard@eljefedelrodeodeljefe ... any further thoughts on this one?

@Qard
Copy link
Member

Qard commented Mar 22, 2016

It worries me a little, but I think I'm 👍 overall. LGTM.

Might be worth discussing more in a docs meeting, but I think we can add to it later rather than blocking.

@MylesBorins
Copy link
Contributor

@eljefedelrodeodeljefe I was just about to land this but noticed the commit message is not so informative. Would you be able to update that? LGTM otherwise

@eljefedelrodeodeljefe
Copy link
ContributorAuthor

I have updated the commit message to reflect intention. Also I have added @Qard's remarks concerning the statefulness of require in this case in a note-section below the example.

Also happy in case we need broader discussion

@jasnell
Copy link
Member

LGTM

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minot nit. I think it is V8.

@eljefedelrodeodeljefe
Copy link
ContributorAuthor

Addressed latest comments and force pushed. @thefourtheye now with semi-colons, thx.

@jasnell
Copy link
Member

ping @thefourtheye

From squashed: remove you reference, @jasnell Also: The intention behind is to present the user a way he/she can execute the node code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Proposed API changes, haven't moved forward. ref: nodejs/node-v0.x-archive#9211, #4955
@eljefedelrodeodeljefe
Copy link
ContributorAuthor

rebased. Also tried to contact @thefourtheye concerning sign-off on slack. But I think he is just incredibly busy.

@thefourtheye
Copy link
Contributor

Really sorry about the delay. LGTM.

@jasnell
Copy link
Member

Awesome, ok, one final ping to @nodejs/documentation as a last call for comments.

@benjamingr
Copy link
Member

LGTM

1 similar comment
@Qard
Copy link
Member

Qard commented Apr 21, 2016

LGTM

jasnell pushed a commit that referenced this pull request Apr 22, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
@jasnell
Copy link
Member

Landed in 6815a3b. Fixed up the commit log a bit

@jasnelljasnell closed this Apr 22, 2016
joelostrowski pushed a commit to joelostrowski/node that referenced this pull request Apr 25, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, nodejs#4955 PR-URL: nodejs#5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
jasnell pushed a commit that referenced this pull request Apr 26, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
@MylesBorins
Copy link
Contributor

@jasnell / @eljefedelrodeodeljefe is this something we want for lts?

@MylesBorins
Copy link
Contributor

MylesBorins pushed a commit that referenced this pull request Jul 11, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
MylesBorins pushed a commit that referenced this pull request Jul 11, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
MylesBorins pushed a commit that referenced this pull request Jul 12, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
@MylesBorinsMylesBorins mentioned this pull request Jul 12, 2016
MylesBorins pushed a commit that referenced this pull request Jul 14, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
MylesBorins pushed a commit that referenced this pull request Jul 14, 2016
The intention behind is to present the user a way to execute code in a vm context. The current API doesn't allow this out-of-the-box, since it is neither passing a require function nor creating context with one. The missing docs for this behaviour have produced a number of Q&A items and have also been discussed in the node-archive repo. In both cases there was no real canonical answer. Refs: nodejs/node-v0.x-archive#9211, #4955 PR-URL: #5323 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Stephen Belanger <[email protected]> Reviewed-By: Myles Borins <[email protected]> Reviewed-By: Sakthipriyan Vairamani <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docIssues and PRs related to the documentations.vmIssues and PRs related to the vm subsystem.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

11 participants

@eljefedelrodeodeljefe@Knighton910@jasnell@Qard@MylesBorins@thefourtheye@benjamingr@silverwind@addaleax@vkurchatkin@mscdex