Skip to content

Global object, this and indirect eval call in vm sandbox #3593

Closed
@eush77

Description

@eush77

I have a couple of questions regarding the behavior of this and (1, eval)("this") in vm.

According to 18.2.1.1 and 8.1.1.4.11 of ECMAScript language specification, this and (1, eval)("this") in the global scope both resolve to the global object, and according to vm module docs, the global object is the sandbox argument to vm.runInNewContext for scripts running this way:

Inside scripts run as such, sandbox will be the global object, retaining all its existing properties but also having the built-in objects and functions any standard global object has.

Is my understanding correct? I don't really understand these results I got:

var vm = require('vm');
var sandbox = vm.createContext();

console.log(sandbox === vm.runInNewContext('this', sandbox)) //=> false (1)
console.log(sandbox === vm.runInNewContext('(1, eval)("this")', sandbox)) //=> false (2)

console.log(vm.runInNewContext('this === (1, eval)("this")', {})) //=> true (3)
console.log(vm.runInNewContext('this === (1, eval)("this")', global)) //=> false (4)
console.log(vm.runInNewContext('this === (1, eval)("this")',
                               Object.create(global))) //=> false (5)

console.log(prototypeChain(Object.create(null)).length) //=> 1 (6)
console.log(prototypeChain(vm.runInNewContext('this',
                                              Object.create(null))).length) //=> 3 (7)

function prototypeChain (object) {
  var chain = [];
  while (object) {
    chain.push(object);
    object = Object.getPrototypeOf(object);
  }
  return chain;
}
  1. Why false in (1) and (2)? I know that e.g. mutating or adding properties to this inside vm is visible outside, is there a technical reason for these objects not being equal and also for the difference between (6) and (7)?
  2. Why is the value of this === (1, eval)("this") not consistent and why does it depend on the presence of global in the sandbox's prototype chain? Is global unique in this regard?
$ node --version
v4.1.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    vmIssues and PRs related to the vm subsystem.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions