Node.js vm:如何取消Script.runInNewContext()？

Question

我想使用该vm模块作为运行外部代码的安全方式.它工作得很好,但还有一个问题:

var UNKNOWN_CODE = "while(true){}";

var vm = require("vm");

var obj = {};
var ctx = vm.createContext(obj);

var script = vm.createScript(UNKNOWN_CODE);

script.runInNewContext(ctx);

console.log("finished"); //never executed

有没有办法取消执行(例如,如果它持续超过5秒)？

提前致谢!

Answer 1

您需要在单独的进程中运行它,例如:

master.js:

var cluster = require('cluster');

cluster.setupMaster({
  exec : "runner.js",
  args : process.argv.slice(2),
  silent : false
});
//This will be fired when the forked process becomes online
cluster.on( "online", function(worker) {
    var timer = 0;

    worker.on( "message", function(msg) {
        clearTimeout(timer); //The worker responded in under 5 seconds, clear the timeout
        console.log(msg);
        worker.destroy(); //Don't leave him hanging 

    });
    timer = setTimeout( function() {
        worker.destroy(); //Give it 5 seconds to run, then abort it
        console.log("worker timed out");
    }, 5000);

    worker.send( 'while(true){}' ); //Send the code to run for the worker
});
cluster.fork();

runner.js:

//The runner.js is ran in a separate process and just listens for the message which contains code to be executed
process.on('message', function( UNKNOWN_CODE ) {

    var vm = require("vm");

    var obj = {};
    var ctx = vm.createContext(obj);

    var script = vm.createScript(UNKNOWN_CODE);

    script.runInNewContext(ctx);

    process.send( "finished" ); //Send the finished message to the parent process
});

要运行此示例,请将这些文件放在同一文件夹和dir中并运行

node master.js

您应该在5秒后看到"工作时间超时"消息.如果将其更改为'while(false){}'worker,则会立即执行代码,您应该看到"finished".

群集文档

Answer 2

您可以将"脚本断开器"嵌入到UNKNOWN_CODE中.就像是:

;setTimeout(function() { throw new Error("Execution time limit reached!") }, 2000);

所以,整个事情看起来像这样:

var UNKNOWN_CODE = "while(true){}";

var scriptBreaker = ';setTimeout(function() { throw new Error("Execution time limit reached!") }, 2000);';

var vm = require("vm");

var obj = {};
var ctx = vm.createContext(obj);

var script = vm.createScript(scriptBreaker + UNKNOWN_CODE);

try {
  script.runInNewContext(ctx);
  console.log("Finished");
}
catch (err) { 
  console.log("Timeout!"); 
  // Handle Timeout Error...
}

更新:

经过更多测试后,我得出的结论是,可靠的方法是使用Esailija指出的流程.但是,我的做法有点不同.

在主应用程序中,我有一个这样的代码:

var cp = require('child_process');

function runUnsafeScript(script, callback) {
 var worker = cp.fork('./script-runner', [script]);

 worker.on('message', function(data) {
  worker.kill();
  callback(false, data);
 });

 worker.on('exit', function (code, signal) {
  callback(new Error(code), false);
 });

 worker.on('error', function (err) {
  callback(err, false);
 });

 setTimeout(function killOnTimeOut() {
  worker.kill();
  callback(new Error("Timeout"), false);
 }, 5000);
}

在script-runner.js中,它看起来如下:

var vm = require("vm");
var script = vm.createScript( process.argv[2] );
var obj = { sendResult:function (result) { process.send(result); process.exit(0); } };
var context = vm.createContext(obj);

script.runInNewContext(context);

process.on('uncaughtException', function(err) {
 process.exit(1);
});

这种方法可以实现以下目标:

• 在有限的上下文中运行脚本
• 避免死循环和异常的问题
• 同时运行许多(受硬件限制)不安全的脚本,因此它们不会互相中断
• 将脚本执行结果传递给主应用程序以进行进一步处理

Answer 3

是的，现在这是可能的，因为我timeout向 Nodevm模块添加了参数支持。您可以简单地传入一个毫秒超时值runInNewContext()，如果代码没有在指定的时间内完成执行，它将抛出异常。

请注意，这并不意味着运行不受信任的代码有任何类型的安全模型。这只是允许您使您信任或以其他方式保护的代码超时。

var vm = require("vm");

try {
    vm.runInNewContext("while(true) {}", {}, "loop", 1000);
} catch (e) {
    // Exception thrown after 1000ms
}

console.log("finished"); // Will now be executed

正是您所期望的：

$ time ./node test.js
finished

real    0m1.069s
user    0m1.047s
sys     0m0.017s