isolated-function 0.0.3 → 0.0.5

package/README.md

@@ -6,8 +6,9 @@
 
 **Highlights**
 
-- Based on [v8-sandbox](https://github.com/fulcrumapp/v8-sandbox).
+- Based in [Node.js Permission Model](https://nodejs.org/api/permissions.html#permission-model)
 - Auto install npm dependencies.
+- Memory limit support.
 - Timeout support.
 
 ## Install
@@ -19,10 +20,10 @@ npm install isolated-function --save
 ## Usage
 
 ```js
-const isoaltedFunction = require('isolated-function')
+const isolatedFunction = require('isolated-function')
 
 /* This function will run in a sandbox, in a separate process */
-const sum = isoaltedFunction((y, z) => y + z)
+const sum = isolatedFunction((y, z) => y + z)
 
 /* Interact with it as usual from your main code */
 const result = await sum(3, 2)
@@ -33,7 +34,7 @@ console.log(result)
 You can also use `require' for external dependencies:
 
 ```js
-const isEmoji = isoaltedFunction(emoji => {
+const isEmoji = isolatedFunction(emoji => {
   const isEmoji = require('is-standard-emoji')
   return isEmoji(emoji)
 })
@@ -48,7 +49,7 @@ It's intentionally not possible to expose any Node.js objects or functions direc
 
 ## API
 
-### isoaltedFunction(snippet, [options])
+### isolatedFunction(snippet, [options])
 
 #### snippet
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "isolated-function",
   "description": "Runs untrusted code in a Node.js v8 sandbox.",
   "homepage": "https://github.com/Kikobeats/isolated-function",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "main": "src/index.js",
   "exports": {
     ".": "./src/index.js"
@@ -33,14 +33,13 @@
     "v8"
   ],
   "dependencies": {
+    "@kikobeats/time-span": "~1.0.5",
     "acorn": "~8.12.1",
     "acorn-walk": "~8.3.3",
     "ensure-error": "~3.0.1",
     "esbuild": "~0.23.1",
-    "process-stats": "~3.7.10",
     "serialize-error": "8",
-    "tinyspawn": "~1.3.2",
-    "v8-sandbox": "~3.2.12"
+    "tinyspawn": "~1.3.2"
   },
   "devDependencies": {
     "@commitlint/cli": "latest",

package/src/compile.js

@@ -11,6 +11,8 @@ const path = require('path')
 
 const generateTemplate = require('./template')
 
+const MINIFY = process.env.ISOLATED_FUNCTIONS_MINIFY !== 'false'
+
 const packageManager = (() => {
   try {
     execSync('which pnpm').toString().trim()
@@ -46,31 +48,35 @@ const detectDependencies = code => {
   return Array.from(dependencies)
 }
 
-module.exports = async snippet => {
-  const tmp = await fs.mkdtemp(path.join(tmpdir(), 'compile-'))
-  await fs.mkdir(tmp, { recursive: true })
+const getTmp = async content => {
+  const cwd = await fs.mkdtemp(path.join(tmpdir(), 'compile-'))
+  await fs.mkdir(cwd, { recursive: true })
 
-  const template = generateTemplate(snippet)
+  const filepath = path.join(cwd, 'index.js')
+  await fs.writeFile(filepath, content)
 
-  const entryFile = path.join(tmp, 'index.js')
-  await fs.writeFile(entryFile, template)
+  const cleanup = () => fs.rm(cwd, { recursive: true, force: true })
+  return { filepath, cwd, content, cleanup }
+}
 
-  const dependencies = detectDependencies(template)
-  await $(packageManager.init, { cwd: tmp })
-  await $(`${packageManager.install} ${dependencies.join(' ')}`, { cwd: tmp })
+module.exports = async snippet => {
+  const tmp = await getTmp(generateTemplate(snippet))
+  const dependencies = detectDependencies(tmp.content)
+  await $(packageManager.init, { cwd: tmp.cwd })
+  await $(`${packageManager.install} ${dependencies.join(' ')}`, {
+    cwd: tmp.cwd
+  })
 
   const result = await esbuild.build({
-    entryPoints: [entryFile],
+    entryPoints: [tmp.filepath],
     bundle: true,
+    minify: MINIFY,
     write: false,
     platform: 'node'
   })
 
-  const bundledCode = result.outputFiles[0].text
-
-  await fs.rm(tmp, { recursive: true })
-
-  return bundledCode
+  await tmp.cleanup()
+  return getTmp(result.outputFiles[0].text)
 }
 
 module.exports.detectDependencies = detectDependencies

package/src/index.js

@@ -1,32 +1,78 @@
 'use strict'
 
-const { Sandbox } = require('v8-sandbox')
 const { deserializeError } = require('serialize-error')
+const timeSpan = require('@kikobeats/time-span')()
+const $ = require('tinyspawn')
+const path = require('path')
 
 const compile = require('./compile')
 
-module.exports = (snippet, { timeout = 10000, globals = {} } = {}) => {
-  if (typeof snippet !== 'function') {
-    throw new TypeError('Expected a function')
-  }
+const createError = ({ name, message, ...props }) => {
+  const error = new Error(message)
+  error.name = name
+  Object.assign(error, props)
+  return error
+}
+
+const flags = ({ filename, memory }) => {
+  const flags = ['--experimental-permission', `--allow-fs-read=${filename}`]
+  if (memory) flags.push(`--max-old-space-size=${memory}`)
+  return flags.join(' ')
+}
+
+module.exports = (snippet, { timeout = 0, memory } = {}) => {
+  if (typeof snippet !== 'function') throw new TypeError('Expected a function')
+  const compilePromise = compile(snippet)
+
+  const fn = async (...args) => {
+    let duration
+    try {
+      const { filepath } = await compilePromise
 
-  const sandbox = new Sandbox({
-    httpEnabled: false,
-    timersEnabled: true,
-    debug: true
-  })
-  const compiling = compile(snippet)
-  const initializing = sandbox.initialize()
-
-  return async (...args) => {
-    const [code] = await Promise.all([compiling, initializing])
-    const { error, value } = await sandbox.execute({
-      code,
-      timeout,
-      globals: { ...globals, arguments: args }
-    })
-    await sandbox.shutdown()
-    if (error) throw require('ensure-error')(deserializeError(error))
-    return value
+      const cwd = path.dirname(filepath)
+      const filename = path.basename(filepath)
+      const cmd = `node ${flags({ filename, memory })} ${filename} ${JSON.stringify(args)}`
+
+      duration = timeSpan()
+      const { stdout } = await $(cmd, {
+        cwd,
+        timeout,
+        killSignal: 'SIGKILL'
+      })
+      const { isFulfilled, value, profiling } = JSON.parse(stdout)
+      profiling.duration = duration()
+      if (isFulfilled) return [value, profiling]
+      throw deserializeError(value)
+    } catch (error) {
+      if (error.signalCode === 'SIGTRAP') {
+        throw createError({
+          name: 'MemoryError',
+          message: 'Out of memory',
+          profiling: { duration: duration() }
+        })
+      }
+
+      if (error.signalCode === 'SIGKILL') {
+        throw createError({
+          name: 'TimeoutError',
+          message: 'Execution timed out',
+          profiling: { duration: duration() }
+        })
+      }
+
+      if (error.code === 'ERR_ACCESS_DENIED') {
+        throw createError({
+          name: 'PermissionError',
+          message: `Access to '${error.permission}' has been restricted`,
+          profiling: { duration: duration() }
+        })
+      }
+
+      throw error
+    }
   }
+
+  const cleanup = async () => (await compilePromise).cleanup
+
+  return [fn, cleanup]
 }

package/src/template/index.js

@@ -2,39 +2,26 @@
 
 const SERIALIZE_ERROR = require('./serialize-error')
 
-const DISALLOW_INTERNALS = [
-  '_dispatch',
-  'base64ToBuffer',
-  'bufferToBase64',
-  'define',
-  'defineAsync',
-  'dispatch',
-  'httpRequest',
-  'info',
-  'setResult'
-]
+const generateTemplate = snippet => `
+  const args = JSON.parse(process.argv[2])
 
-const generateTemplate = snippet => {
-  const value = (() => {
-    return `await (() => {
-      let ${DISALLOW_INTERNALS.join(',')};
-      globalThis = { clearTimeout, setTimeout }
-      globalThis.global = globalThis
-      return (${snippet.toString()})(...arguments)
-    })()`
-  })()
+  ;(async () => {
+    let value
+    let isFulfilled
 
-  const template = `;(async () => {
-  try {
-    setResult({
-      value: ${value}
-    })
-  } catch(error) {
-   setResult({ error: ${SERIALIZE_ERROR}(error) })
-  }
-})()`
-
-  return template
-}
+    try {
+      value = await (${snippet.toString()})(...args)
+      isFulfilled = true
+    } catch (error) {
+      value = ${SERIALIZE_ERROR}(error)
+      isFulfilled = false
+    } finally {
+      console.log(JSON.stringify({
+        isFulfilled,
+        value,
+        profiling: { memory: process.memoryUsage().rss }
+      }))
+    }
+  })()`
 
 module.exports = generateTemplate