From 23c45554ce02b39bdce6c7a6feed2a83d0769e21 Mon Sep 17 00:00:00 2001 From: Ruslan Bekenev Date: Sat, 25 Feb 2017 23:11:50 +0300 Subject: [PATCH 1/4] doc: add note that vm module is not a security mechanism the text added in this commit should warn users about wrong idea that vm module can be secure to run unsafe scripts in sandboxes --- doc/api/vm.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/api/vm.md b/doc/api/vm.md index 025e9725a94e66..2700bd05491dcb 100644 --- a/doc/api/vm.md +++ b/doc/api/vm.md @@ -14,6 +14,8 @@ const vm = require('vm'); JavaScript code can be compiled and run immediately or compiled, saved, and run later. +*Note*: The vm module makes a wrong impression as a security mechanism. In fact, it is not at all, you shouldn't use it to run untrusted scripts. + ## Class: vm.Script