Get user's input and use it as a Function

Question

I am working on a test case visualizer where the user can run his code and check if it is correct. I'm using Node Js and I'm getting user's code from a text-area. Assuming that this is what I'm getting from the user:

function add(x, y) {
    return x + y;
}

And this is what I'm doing at the backend:

app.post("/main", function(req, res) {
    console.log("hello");
    var x = 1;
    var y = 2;
    req.body.code //missing
})

How can I use this input as a function and run it to get the values?

And then one day, the user sends while(true);

VLAZ
– VLAZ

2021-05-30 08:59:08 +00:00
Commented May 30, 2021 at 8:59 — VLAZ
– VLAZ, Commented May 30, 2021 at 8:59

Enslev · Accepted Answer · 2021-06-24 14:06:57Z

2

Do NOT use eval() !!

Running arbitrary code from a user on your server might be the easiest way I have ever heard of to get hacked. Any user can do anything they want with your server if you do this.

There are numerous parsers (like esprima) that can parse/validate the code without actually running it. Go for one of those instead of opening the front door to your server.

answered Jun 24, 2021 at 14:06

Enslev

6123 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

hadi youness · Accepted Answer · 2021-07-01 19:56:08Z

What I ended up doing is that I used vm2 sandbox

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. It works well, and you can limit access to certain methods.

First require it:

const { VM } = require('vm2');

then, specify the timeout, and the sandbox:

const vm = new VM({
    console: 'inherit',
    timeout: 1000,
    sandbox: { global_variable },
    require: {
        external: true,
    },
});

global_variable is nothing but a "var" that I used to export the output.

Now let's use the following function in a string named "func":

function Main(x,y){
return x+y};

concatenate it with:

global_variable.exports=Main(5,5);

Now run the code via:

vm.run("func")

To print the answer, just do:

global_variable.exports;

This solution works only if you have a javascript code that you need to run. I am still looking for other solutions that run for multiple languages in node js. If you have any suggestions please do let me know.

Mohamad Chamanmotlagh · Accepted Answer · 2021-06-24 13:53:18Z

-2

The simplest way would be using eval() function. Say, your client passes function as a string to the server (code parameter in body). So you can do this:

Just a reminder: This method is very unsafe and it's not a good practice to use eval, so depending on you situation, you may be able to use other methods

app.post("/main", function(req, res) {
  console.log("hello");
  var x = 1;
  var y = 2;
  eval(req.body.code); // This will return an Error if code is wrong
  add(x,y);
})

edited Jun 24, 2021 at 13:53

answered May 30, 2021 at 9:44

Mohamad Chamanmotlagh

3421 gold badge3 silver badges16 bronze badges

Collectives™ on Stack Overflow

Get user's input and use it as a Function

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related