Isolierte Skriptausführungs-Sandbox mittels Node.js-VM-Kontexten

import vm from 'node:vm';
 
function executeInSandbox(untrustedCode, contextGlobals) {
  const sandbox = vm.createContext(Object.create(null, {
    ...Object.getOwnPropertyDescriptors(contextGlobals),
    Math: { value: Math, writable: false, configurable: false }
  }));
 
  const script = new vm.Script(untrustedCode, { filename: 'sandbox.vm.js' });
  return script.runInContext(sandbox, {
    timeout: 100,
    breakOnSigint: true
  });
}
 
const result = executeInSandbox('x * 2 + Math.PI', { x: 10 });