Vm2: Infinite loop in Promise.then hangs whole process

Created on 12 Jan 2018 · 4Comments · Source: patriksimek/vm2

This code disregards the timeout and hangs the process:

'use strict'

const {VM} = require('vm2')

const vm = new VM({
    timeout: 5000,
})

console.log('Runs')

vm.run('Promise.resolve(42).then(() => {while(true) {}})') // hangs the process

setImmediate(console.log, 'Will never run')

And Promise can't be easily disabled: #74.

stale

Source

wojpawlik

👍8

All 4 comments

Readme.md

IMPORTANT: Timeout is not effective for NodeVM so it is not immune to while (true) {} or similar evil.

awiebe on 19 Jan 2018

👎6

@awiebe except, I'm using VM, not NodeVM.

wojpawlik on 19 Jan 2018

Unfortunately, this is another limitation of node's timeout feature - it doesn't work for asynchronous calls, even if they're running in the sandbox.

patriksimek on 19 Jan 2018

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.