undefined | Better HN

0 pointssimonw3mo ago0 comments

I want to build features - both client- and server-side - where users can provide JavaScript code that I then execute safely.

Just having a WebAssembly engine available isn't enough for this - something has to take that user-provided string of JavaScript and execute it within a safe sandbox.

Generally that means you need a JavaScript interpreter that has itself been compiled to WebAssembly. I've experimented with QuickJS itself for that in the past - demo here: https://tools.simonwillison.net/quickjs - but MicroQuickJS may be interesting as a smaller alternative.

If there's a better option than that I'd love to hear about it!

0 comments

santadays3mo ago

GraalVM supports running javascript in a sandbox with a bunch of convenient options for running untrusted code.

https://www.graalvm.org/latest/security-guide/sandboxing/

simonwOP3mo ago

Oh that looks neat! It appears to have the memory limits I want (engine.MaxIsolateMemory) and a robust CPU limit: sandbox.MaxCPUTime

One catch: the sandboxing feature isn't in the "community edition", so only available under the non-open-source (but still sometimes free, I think?) Oracle GraalVM.

MobiusHorizons3mo ago

This is generally the purpose of JavaScript execution environments like v8 or jsc (or quickjs although I understand not trusting that as a sandbox to the same degree). They are specifically intended for executing untrusted scripts (eg web browsers). Web assembly’s sandboxing comes from js sandboxing, since it was originally a feature of the same programs for the same reasons. Wrapping one sandbox in another is what I’m surprised by.

simonwOP3mo ago

Running v8 itself as a sandbox is non-trivial, at least embedded in a Python or Node.js or similar application.

The web is littered with libraries that half do that and then have a note in the README that says "do not rely on this as a secure sandbox".

MobiusHorizons3mo ago

Is it though? I have not personally used these libraries, but a cursory google search reveals several options: - cloudflare/STPyV8: [0] From cloudflare, intended for executing untrusted code. - Pythonmonkey: [1] Embeds spidermonkey. Not clearly security focused, but sandboxing untrusted code is literally the point of browser js engines.

It's a little less clear how you would do this from node, but the v8 embedding instructions should work https://v8.dev/docs/embed even if nodejs is already a copy of v8.

[0]: https://github.com/cloudflare/stpyv8 [1]: https://docs.pythonmonkey.io

1 more reply

j / k navigate · click thread line to collapse

0 pointssimonw3mo ago0 comments

I want to build features - both client- and server-side - where users can provide JavaScript code that I then execute safely.

Just having a WebAssembly engine available isn't enough for this - something has to take that user-provided string of JavaScript and execute it within a safe sandbox.

If there's a better option than that I'd love to hear about it!

0 comments

santadays3mo ago

GraalVM supports running javascript in a sandbox with a bunch of convenient options for running untrusted code.

https://www.graalvm.org/latest/security-guide/sandboxing/

simonwOP3mo ago

Oh that looks neat! It appears to have the memory limits I want (engine.MaxIsolateMemory) and a robust CPU limit: sandbox.MaxCPUTime

One catch: the sandboxing feature isn't in the "community edition", so only available under the non-open-source (but still sometimes free, I think?) Oracle GraalVM.

MobiusHorizons3mo ago

simonwOP3mo ago

Running v8 itself as a sandbox is non-trivial, at least embedded in a Python or Node.js or similar application.

The web is littered with libraries that half do that and then have a note in the README that says "do not rely on this as a secure sandbox".

MobiusHorizons3mo ago

It's a little less clear how you would do this from node, but the v8 embedding instructions should work https://v8.dev/docs/embed even if nodejs is already a copy of v8.

[0]: https://github.com/cloudflare/stpyv8 [1]: https://docs.pythonmonkey.io

1 more reply

j / k navigate · click thread line to collapse