Overriding functions of objects from sandbox parameter inside NodeVM about vm2 HOT 3 CLOSED

This is expected and wanted.
If an object should not be altered from within the sandbox readonly can be used.

const vm = new NodeVM({
  console: 'inherit',
  eval: false,
  wasm: false,
  require: {
    builtin: ['buffer', 'crypto', 'querystring', 'string_decoder', 'url', 'util']
  }
});
vm.sandbox.myObject = vm.readonly(myObject);

from vm2.

Maybe i missed some but this:

` const myObject = { myvalue: 1 }
myObject.isAdmin = function() { console.log("Hello from the outside function!"); return false; }
console.log(myObject.isAdmin())

const vm = new NodeVM({
console: 'inherit',
sandbox: { myObject },
eval: false,
wasm: false,
require: {
builtin: ['buffer', 'crypto', 'querystring', 'string_decoder', 'url', 'util']
}
});
vm.sandbox.myObject = vm.readonly(myObject);
let javascriptString = 'myObject.isAdmin = function() { console.log("Hello from within the VM!"); return true; }'

functionScript = new VMScript(
'module.exports = async function () {\n' + javascriptString + '\n}'
).compile()

let functionInSandbox = vm.run(functionScript);
functionInSandbox();

console.log(myObject.isAdmin())`

leads to that output:

Hello from the outside function! false Hello from within the VM! true

from vm2.

Yes, you need to delete then sandbox: { myObject }, line as it exposes the object into the sandbox and therefore the readonly call does not have an effect.

from vm2.