isolated-function 0.1.35 → 0.1.36

package/package.json

@@ -2,7 +2,7 @@
   "name": "isolated-function",
   "description": "Runs untrusted code in a Node.js v8 sandbox.",
   "homepage": "https://github.com/Kikobeats/isolated-function",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "main": "src/index.js",
   "exports": {
     ".": "./src/index.js"

package/src/index.js

@@ -15,17 +15,18 @@ const createError = ({ name, message, ...props }) => {
   return error
 }
 
-const [major] = process.version.slice(1).split('.').map(Number)
+const [nodeMajor] = process.version.slice(1).split('.').map(Number)
 
-const PERMISSION_FLAG = major >= 24 ? '--permission' : '--experimental-permission'
+const PERMISSION_FLAG = nodeMajor >= 24 ? '--permission' : '--experimental-permission'
 
-const flags = ({ memory }) => {
+const flags = ({ memory, allow }) => {
   const flags = ['--disable-warning=ExperimentalWarning', PERMISSION_FLAG]
   if (memory) flags.push(`--max-old-space-size=${memory}`)
+  allow.forEach(resource => flags.push(`--allow-${resource}`))
   return flags.join(' ')
 }
 
-module.exports = (snippet, { tmpdir, timeout, memory, throwError = true } = {}) => {
+module.exports = (snippet, { tmpdir, timeout, memory, throwError = true, allow = [] } = {}) => {
   if (!['function', 'string'].includes(typeof snippet)) throw new TypeError('Expected a function')
   const compilePromise = compile(snippet, tmpdir)
 
@@ -38,7 +39,7 @@ module.exports = (snippet, { tmpdir, timeout, memory, throwError = true } = {})
       const subprocess = $('node', ['-', JSON.stringify(args)], {
         env: {
           ...process.env,
-          NODE_OPTIONS: flags({ memory })
+          NODE_OPTIONS: flags({ memory, allow })
         },
         timeout,
         killSignal: 'SIGKILL'
@@ -77,9 +78,15 @@ module.exports = (snippet, { tmpdir, timeout, memory, throwError = true } = {})
       }
 
       if (error.code === 'ERR_ACCESS_DENIED') {
+        const permission = error.permission
+          ? error.permission
+          : error.message.includes('getaddrinfo')
+            ? 'network'
+            : undefined
+
         throw createError({
           name: 'PermissionError',
-          message: `Access to '${error.permission}' has been restricted`,
+          message: `Access to '${permission}' has been restricted`,
           profiling: { duration: duration() }
         })
       }