Jorge, That's an interesting approach, however it does not support windows, am I correct? How about it's stability, I can see that it's in 0.1.4, are you confident running it in production?
Thanks, Gustavo Machado machad...@gmail.com On Jan 20, 2013, at 8:32 AM, Jorge Chamorro <jo...@jorgechamorro.com> wrote: > On 16/01/2013, at 22:24, Gustavo Machado wrote: > >> Hello, >> >> We are building a platform that is oriented to developers in node.js, and we >> are in the process of evaluating giving our users the ability to configure >> validation and authorisation rules in Javascript. >> >> On virtually every request, these validation rules are going to be executed, >> so it needs to be somewhat performant, but most importantly "safe". And by >> safe I mean: >> >> - no require-ing >> - no access to global >> - any kind of attack that may give access to the local system (files, >> network, etc) >> >> So far, we found the "sandbox" module: >> https://github.com/gf3/sandbox/blob/master/example/example.js but are >> looking for some other choices. >> >> Thanks, >> Gustavo Machado > > V8 Isolates run isolated code, share nothing with node's JS context and don't > have any means for IO. > > With Threads A GoGo (<https://github.com/xk/node-threads-a-gogo/>) you can > create a JS thread that runs in a V8 isolate, pass it a function (serialized, > as text), execute it with some parameters (serialized, as text), and get back > a result (serialized, as text). > > The only means for IO a thread in TAGG has are: > > 1.- The built-in `puts(text)` cmd that writes to stdout, but it can be > deleted. > 2.- The thread.emit() method, but it can be deleted as well. > > So basically the clients' code you could run with 100% safety in a TAGG > thread could be +/- a function like this: > > function clientProcedure (data) { > //process data > return result; > } > > And you'd do it so: > > var aThread= require('threads-a-gogo').create() > .eval('delete puts') > .eval('delete thread.emit') > .eval('(' + clientProcedure + ')(' + data + ')', cb); > > function cb (result) { > //here you'd receive the result of clientProcedure(data); > aThread.destroy(); > } > > > -- > Jorge. > > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to nodejs@googlegroups.com > To unsubscribe from this group, send email to > nodejs+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en -- Job Board: http://jobs.nodejs.org/ Posting guidelines: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines You received this message because you are subscribed to the Google Groups "nodejs" group. To post to this group, send email to nodejs@googlegroups.com To unsubscribe from this group, send email to nodejs+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/nodejs?hl=en?hl=en
