vm.createContext and inheritance

[jankuca]

The VM context created via vm.createContext does only contain own keys of the object passed to it.

var a = { x: 1 };
var b = Object.create(a);

var ctx_a = vm.createContext(a);
var ctx_b = vm.createContext(b);

vm.runInContext('x', ctx_a); // 1
vm.runInContext('x', ctx_b); // ReferenceError: x is not defined

Is this the correct behavior? Is this to prevent functions such as hasOwnProperty to exist in the context?

[bnoordhuis]

Is this the correct behavior? Is this to prevent functions such as hasOwnProperty to exist in the context?

Kind of. We use Object.getOwnPropertyNames(obj) to populate the VM context object. The idea is to stop evaluated code from (accidentally or intentionally) breaking out of the sandbox by walking the prototype chain.

[bnoordhuis]

Let me add the caveat emptor that the vm module is not designed as a secure environment for running arbitrary code. It's a convenience tool for running trusted code in a clean slate environment.

[jankuca]

OK, thanks. That's what I figured.