Method constructor

lib/nodevm.js:252–433

* Create a new NodeVM instance. * * Unlike VM, NodeVM lets you use require same way like in regular node. * * However, it does not use the timeout. * * @public * @param {Object} [options] - VM options. * @param {Object} [options.sandbox] - Objects that will be copied into the

(options = {})

	 * @throws {VMError} If the compiler is unknown.
	 */
	constructor(options = {}) {
		const {
			compiler,
			eval: allowEval,
			wasm,
			console: consoleType = 'inherit',
			require: requireOpts = false,
			nesting = false,
			wrapper = 'commonjs',
			sourceExtensions = ['js'],
			argv,
			env,
			strict = false,
			sandbox,
			timeout,
			allowAsync,
			bufferAllocLimit
		} = options;

		// SECURITY (GHSA-m4wx-m65x-ghrr, supersedes GHSA-8hg8-63c5-gwmx):
		// A truthy `nesting` injects a NESTING_OVERRIDE builtin that exposes
		// `vm2` to the sandbox. When `requireOpts` is not a real require-config
		// object, `makeResolverFromLegacyOptions` produces a resolver whose ONLY
		// builtin is `vm2` — a pure escape primitive (sandbox does
		// `require('vm2')`, builds an inner NodeVM with attacker-chosen
		// `require` config, reaches `child_process` for host RCE).
		//
		// The guard mirrors the actual reachability of that insecure resolver
		// on two axes:
		//
		// 1. `nesting` truthiness, not strict `=== true`. The override is gated
		//    a few lines below by `nesting && NESTING_OVERRIDE`, which fires for
		//    ANY truthy value (`1`, `'yes'`, `{}`, `[]`, etc.). The check must
		//    cover every truthy `nesting` value the override gate accepts.
		//
		// 2. `requireOpts` must be an actual require-config object (or a
		//    `Resolver` instance), not just "truthy". `makeResolverFromLegacyOptions`
		//    destructures every primitive/function value to all-`undefined` and
		//    falls into the same NESTING_OVERRIDE-only `if (!options)` branch as
		//    falsy values do. The shapes that collapse to the insecure resolver:
		//      - `require: false` / `undefined` / `null` / `0` / `''`
		//          → falsy → `if (!options)` branch
		//      - `require: true` / `1` / `'yes'` / `Symbol()` / `function(){}`
		//          → truthy non-object → destructured to all-undefined →
		//             `makeBuiltinsFromLegacyOptions(undefined, …, override)` →
		//             same NESTING_OVERRIDE-only resolver
		//    The documented escape hatch (a truthy `nesting` + an explicit
		//    `require` config object, even `{}`) continues to work — a non-null
		//    object counts as the developer's deliberate acknowledgment of the
		//    tradeoff. A custom `Resolver` instance is also accepted (the
		//    `customResolver` path below bypasses `makeResolverFromLegacyOptions`
		//    entirely, so NESTING_OVERRIDE is never injected into it).
		const hasRealRequireConfig =
			requireOpts instanceof Resolver
			|| (typeof requireOpts === 'object' && requireOpts !== null);
		if (nesting && !hasRealRequireConfig) {
			throw new VMError(
				'NodeVM `nesting` requires an explicit `require` config object. '