{"action":"created","issue":{"url":"https://api.github.com/repos/marko-js/marko/issues/192","labels_url":"https://api.github.com/repos/marko-js/marko/issues/192/labels{/name}","comments_url":"https://api.github.com/repos/marko-js/marko/issues/192/comments","events_url":"https://api.github.com/repos/marko-js/marko/issues/192/events","html_url":"https://github.com/marko-js/marko/issues/192","id":124079309,"number":192,"title":"Find way to securely load and run templates within sandbox","user":{"login":"philidem","id":2395134,"avatar_url":"https://avatars.githubusercontent.com/u/2395134?v=3","gravatar_id":"","url":"https://api.github.com/users/philidem","html_url":"https://github.com/philidem","followers_url":"https://api.github.com/users/philidem/followers","following_url":"https://api.github.com/users/philidem/following{/other_user}","gists_url":"https://api.github.com/users/philidem/gists{/gist_id}","starred_url":"https://api.github.com/users/philidem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philidem/subscriptions","organizations_url":"https://api.github.com/users/philidem/orgs","repos_url":"https://api.github.com/users/philidem/repos","events_url":"https://api.github.com/users/philidem/events{/privacy}","received_events_url":"https://api.github.com/users/philidem/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/marko-js/marko/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/marko-js/marko/labels/help-wanted","name":"help-wanted","color":"bfe5bf"},{"url":"https://api.github.com/repos/marko-js/marko/labels/marko-v3","name":"marko-v3","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":36,"created_at":"2015-12-28T15:15:43Z","updated_at":"2015-12-28T18:19:57Z","closed_at":null,"body":"Several people have asked about the security implications of allowing end-users to edit Marko templates. I too have wished for this ability but have held off allowing it because it is currently unsafe. We should assess the options for loading and running templates within a sandbox. Examples of unsafe template code includes scriptlets (e.g. `{% process.exit(1) %}`) and JavaScript expressions (e.g. `<div if=\"process.exit(1)\">`). Also, the CommonJS/Node.js `require` function is currently exposed to the template which would allow the template to access the module cache (this is dangerous).\r\n\r\nTo ideas have been proposed to support this:\r\n\r\n1. Use the Node.js built-in `vm` module to load and run Marko templates within a sandbox\r\n2. Staticly analyze the Marko template source code to find unsafe code and prevent compilation or provide whitelist of tags and features that can be used in sandbox mode\r\n\r\nPersonally, I think option `2` (static analysis) would be too error-prone but it is worth exploring."},"comment":{"url":"https://api.github.com/repos/marko-js/marko/issues/comments/167619612","html_url":"https://github.com/marko-js/marko/issues/192#issuecomment-167619612","issue_url":"https://api.github.com/repos/marko-js/marko/issues/192","id":167619612,"user":{"login":"AminaG","id":3584317,"avatar_url":"https://avatars.githubusercontent.com/u/3584317?v=3","gravatar_id":"","url":"https://api.github.com/users/AminaG","html_url":"https://github.com/AminaG","followers_url":"https://api.github.com/users/AminaG/followers","following_url":"https://api.github.com/users/AminaG/following{/other_user}","gists_url":"https://api.github.com/users/AminaG/gists{/gist_id}","starred_url":"https://api.github.com/users/AminaG/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AminaG/subscriptions","organizations_url":"https://api.github.com/users/AminaG/orgs","repos_url":"https://api.github.com/users/AminaG/repos","events_url":"https://api.github.com/users/AminaG/events{/privacy}","received_events_url":"https://api.github.com/users/AminaG/received_events","type":"User","site_admin":false},"created_at":"2015-12-28T18:19:57Z","updated_at":"2015-12-28T18:19:57Z","body":" Maybe try add the creator of vm2, to the conversion..."}}