Skip to content

doc: add note that vm module is not a security mechanism #11557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
krydos wants to merge 4 commits into from
Closed

doc: add note that vm module is not a security mechanism #11557

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
23c4555
doc: add note that vm module is not a security mechanism
krydos Feb 25, 2017
03f5472
doc: line wrap and sentence is more informal now
krydos Feb 26, 2017
bfef1e3
doc: changed wording
krydos Feb 27, 2017
f86040c
doc: bold important sentence
krydos Feb 28, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
doc: add note that vm module is not a security mechanism 
the text added in this commit should warn users about
wrong idea that vm module can be secure to run unsafe scripts
in sandboxes
  • Loading branch information
@krydos
krydos committed Mar 5, 2017
commit 23c45554ce02b39bdce6c7a6feed2a83d0769e21
2 changes: 2 additions & 0 deletions doc/api/vm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ const vm = require('vm');
JavaScript code can be compiled and run immediately or compiled, saved, and run
later.

*Note*: The vm module makes a wrong impression as a security mechanism. In fact, it is not at all, you shouldn't use it to run untrusted scripts.
Copy link
Copy Markdown
Member

@jasnell jasnell Feb 25, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please line wrap at 80 chars.
Also, please avoid the use of informal pronouns like you.

Copy link
Copy Markdown
Member

@Trott Trott Feb 26, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about something more like this?:

The `vm` module is not a security mechanism. Do not use it to run untrusted scripts.


## Class: vm.Script
<!-- YAML
added: v0.3.1
Expand Down