How to safely execute unknown Javascript code in Node.js?

Question

I need to run code provided by an unknown source that checks or sorts something.

How can I do this safely in Node.js?

Python has RestrictedPython , something like that?

There is also ADsafe for the browser, but can it be used in Node.js?

Answer 1

Node has a great tool for this, node.vm. Basically you can run a script in your own context, effectively isolate it.

Of course, since Node runs on a single thread, a malicious script can always shut down your server by simply doing:

while (true) {;} 

To be completely secure, you need to create a new process and use messaging to communicate.