-
Notifications
You must be signed in to change notification settings - Fork 167
Description
I am looking for a way to execute untrusted code that comes in a form of ES module. The module exports a single function that takes a parameter context
which contains some data but also an object with a function that allows untrusted code to make http calls httpClient
, the untrusted code should only make outbound calls through this client. I was trying to achieve this with somethings like this:
`
const module = await isolate.compileModule('export default (async function (context) { return await context.client.fetch(...);});');
await module.instantiate(context, (specifier: string, referrer: Module): Module => {
return referrer;
});
await module.evaluate({ reference: true });
const reference = module.namespace;
const defaultExport = await reference.get('default', { reference: true });
const client = { fetch: (url: string, config: FetchConfig, timeout?: number) => Promise<string> { /* axios fetch logic*/} }
const contextObject = {
...contextData,
client: {
fetch: new Callback(async (url: string, config: FetchConfig, timeout?: number) => {
return await client.fetch(url, config, timeout)
}, { async: true }),
}
}
const result = await defaultExport.apply(null, [ new ExternalCopy(contextObject).copyInto() ], { result: { promise: true, copy: true } });
isolate.dispose();
`
It gives me [object Promise] could not be cloned
error though.
Does isolated-vm support support async callbacks? The CallbackOptions seem to indicate that it does as it has async: boolean|undefined
flag.
I also looked into an option of creating a closure or another module that would allow me to wrap a call to the default function with a code that injects client object with fetch function into the context before it calls the default func, something like here #521, but I haven't figured if it's possible to create a closure which references module, or how to compile a module passing in Reference and Isolate.