index.d.ts 8.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212
  1. import {EventEmitter} from 'events';
  2. /**
  3. * Require options for a VM
  4. */
  5. export interface VMRequire {
  6. /** Array of allowed built-in modules, accepts ["*"] for all. Using "*" increases the attack surface and potential
  7. * new modules allow to escape the sandbox. (default: none) */
  8. builtin?: string[];
  9. /*
  10. * `host` (default) to require modules in host and proxy them to sandbox. `sandbox` to load, compile and
  11. * require modules in sandbox. Built-in modules except `events` always required in host and proxied to sandbox
  12. */
  13. context?: "host" | "sandbox";
  14. /** `true`, an array of allowed external modules or an object with external options (default: `false`) */
  15. external?: boolean | string[] | { modules: string[], transitive: boolean };
  16. /** Array of modules to be loaded into NodeVM on start. */
  17. import?: string[];
  18. /** Restricted path(s) where local modules can be required (default: every path). */
  19. root?: string | string[];
  20. /** Collection of mock modules (both external or built-in). */
  21. mock?: any;
  22. /* An additional lookup function in case a module wasn't found in one of the traditional node lookup paths. */
  23. resolve?: (moduleName: string, parentDirname: string) => string | undefined;
  24. /** Custom require to require host and built-in modules. */
  25. customRequire?: (id: string) => any;
  26. /** Load modules in strict mode. (default: true) */
  27. strict?: boolean;
  28. }
  29. /**
  30. * A custom compiler function for all of the JS that comes
  31. * into the VM
  32. */
  33. type CompilerFunction = (code: string, filename: string) => string;
  34. /**
  35. * Options for creating a VM
  36. */
  37. export interface VMOptions {
  38. /**
  39. * `javascript` (default) or `coffeescript` or custom compiler function (which receives the code, and it's file path).
  40. * The library expects you to have coffee-script pre-installed if the compiler is set to `coffeescript`.
  41. */
  42. compiler?: "javascript" | "coffeescript" | CompilerFunction;
  43. /** VM's global object. */
  44. sandbox?: any;
  45. /**
  46. * Script timeout in milliseconds. Timeout is only effective on code you run through `run`.
  47. * Timeout is NOT effective on any method returned by VM.
  48. */
  49. timeout?: number;
  50. /**
  51. * If set to `false` any calls to eval or function constructors (`Function`, `GeneratorFunction`, etc.) will throw an
  52. * `EvalError` (default: `true`).
  53. */
  54. eval?: boolean;
  55. /**
  56. * If set to `false` any attempt to compile a WebAssembly module will throw a `WebAssembly.CompileError` (default: `true`).
  57. */
  58. wasm?: boolean;
  59. /**
  60. * If set to `true` any attempt to run code using async will throw a `VMError` (default: `false`).
  61. * @deprecated Use `allowAsync` instead.
  62. */
  63. fixAsync?: boolean;
  64. /**
  65. * If set to `false` any attempt to run code using async will throw a `VMError` (default: `true`).
  66. */
  67. allowAsync?: boolean;
  68. }
  69. /**
  70. * Options for creating a NodeVM
  71. */
  72. export interface NodeVMOptions extends VMOptions {
  73. /** `inherit` to enable console, `redirect` to redirect to events, `off` to disable console (default: `inherit`). */
  74. console?: "inherit" | "redirect" | "off";
  75. /** `true` or an object to enable `require` options (default: `false`). */
  76. require?: boolean | VMRequire;
  77. /** **WARNING**: This should be disabled. It allows to create a NodeVM form within the sandbox which could return any host module.
  78. * `true` to enable VMs nesting (default: `false`). */
  79. nesting?: boolean;
  80. /** `commonjs` (default) to wrap script into CommonJS wrapper, `none` to retrieve value returned by the script. */
  81. wrapper?: "commonjs" | "none";
  82. /** File extensions that the internal module resolver should accept. */
  83. sourceExtensions?: string[];
  84. /**
  85. * Array of arguments passed to `process.argv`.
  86. * This object will not be copied and the script can change this object.
  87. */
  88. argv?: string[];
  89. /**
  90. * Environment map passed to `process.env`.
  91. * This object will not be copied and the script can change this object.
  92. */
  93. env?: any;
  94. /** Run modules in strict mode. Required modules are always strict. */
  95. strict?: boolean;
  96. }
  97. /**
  98. * VM is a simple sandbox, without `require` feature, to synchronously run an untrusted code.
  99. * Only JavaScript built-in objects + Buffer are available. Scheduling functions
  100. * (`setInterval`, `setTimeout` and `setImmediate`) are not available by default.
  101. */
  102. export class VM {
  103. constructor(options?: VMOptions);
  104. /** Direct access to the global sandbox object */
  105. readonly sandbox: any;
  106. /** Timeout to use for the run methods */
  107. timeout?: number;
  108. /** Runs the code */
  109. run(script: string|VMScript, options?: string|{filename?: string}): any;
  110. /** Runs the code in the specific file */
  111. runFile(filename: string): any;
  112. /** Loads all the values into the global object with the same names */
  113. setGlobals(values: any): this;
  114. /** Make a object visible as a global with a specific name */
  115. setGlobal(name: string, value: any): this;
  116. /** Get the global object with the specific name */
  117. getGlobal(name: string): any;
  118. /** Freezes the object inside VM making it read-only. Not available for primitive values. */
  119. freeze(object: any, name?: string): any;
  120. /** Freezes the object inside VM making it read-only. Not available for primitive values. */
  121. readonly(object: any): any;
  122. /** Protects the object inside VM making impossible to set functions as it's properties. Not available for primitive values */
  123. protect(object: any, name?: string): any;
  124. }
  125. /**
  126. * A VM with behavior more similar to running inside Node.
  127. */
  128. export class NodeVM extends EventEmitter implements VM {
  129. constructor(options?: NodeVMOptions);
  130. /** Require a module in VM and return it's exports. */
  131. require(module: string): any;
  132. /**
  133. * Create NodeVM and run code inside it.
  134. *
  135. * @param {string} script JavaScript code.
  136. * @param {string} [filename] File name (used in stack traces only).
  137. * @param {Object} [options] VM options.
  138. */
  139. static code(script: string, filename?: string, options?: NodeVMOptions): any;
  140. /**
  141. * Create NodeVM and run script from file inside it.
  142. *
  143. * @param {string} [filename] File name (used in stack traces only).
  144. * @param {Object} [options] VM options.
  145. */
  146. static file(filename: string, options?: NodeVMOptions): any;
  147. /** Direct access to the global sandbox object */
  148. readonly sandbox: any;
  149. /** Only here because of implements VM. Does nothing. */
  150. timeout?: number;
  151. /** Runs the code */
  152. run(js: string|VMScript, options?: string|{filename?: string, wrapper?: "commonjs" | "none", strict?: boolean}): any;
  153. /** Runs the code in the specific file */
  154. runFile(filename: string): any;
  155. /** Loads all the values into the global object with the same names */
  156. setGlobals(values: any): this;
  157. /** Make a object visible as a global with a specific name */
  158. setGlobal(name: string, value: any): this;
  159. /** Get the global object with the specific name */
  160. getGlobal(name: string): any;
  161. /** Freezes the object inside VM making it read-only. Not available for primitive values. */
  162. freeze(object: any, name?: string): any;
  163. /** Freezes the object inside VM making it read-only. Not available for primitive values. */
  164. readonly(object: any): any;
  165. /** Protects the object inside VM making impossible to set functions as it's properties. Not available for primitive values */
  166. protect(object: any, name?: string): any;
  167. }
  168. /**
  169. * You can increase performance by using pre-compiled scripts.
  170. * The pre-compiled VMScript can be run later multiple times. It is important to note that the code is not bound
  171. * to any VM (context); rather, it is bound before each run, just for that run.
  172. */
  173. export class VMScript {
  174. constructor(code: string, path: string, options?: {
  175. lineOffset?: number;
  176. columnOffset?: number;
  177. compiler?: "javascript" | "coffeescript" | CompilerFunction;
  178. });
  179. constructor(code: string, options?: {
  180. filename?: string,
  181. lineOffset?: number;
  182. columnOffset?: number;
  183. compiler?: "javascript" | "coffeescript" | CompilerFunction;
  184. });
  185. readonly code: string;
  186. readonly filename: string;
  187. readonly lineOffset: number;
  188. readonly columnOffset: number;
  189. readonly compiler: "javascript" | "coffeescript" | CompilerFunction;
  190. /**
  191. * Wraps the code
  192. * @deprecated
  193. */
  194. wrap(prefix: string, postfix: string): this;
  195. /** Compiles the code. If called multiple times, the code is only compiled once. */
  196. compile(): this;
  197. }
  198. /** Custom Error class */
  199. export class VMError extends Error {}