{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/2503","labels_url":"https://api.github.com/repos/nodejs/node/issues/2503/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/2503/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/2503/events","html_url":"https://github.com/nodejs/node/issues/2503","id":102587938,"number":2503,"title":"Require does not work as expected within vm","user":{"login":"reggi","id":296798,"avatar_url":"https://avatars.githubusercontent.com/u/296798?v=3","gravatar_id":"","url":"https://api.github.com/users/reggi","html_url":"https://github.com/reggi","followers_url":"https://api.github.com/users/reggi/followers","following_url":"https://api.github.com/users/reggi/following{/other_user}","gists_url":"https://api.github.com/users/reggi/gists{/gist_id}","starred_url":"https://api.github.com/users/reggi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reggi/subscriptions","organizations_url":"https://api.github.com/users/reggi/orgs","repos_url":"https://api.github.com/users/reggi/repos","events_url":"https://api.github.com/users/reggi/events{/privacy}","received_events_url":"https://api.github.com/users/reggi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/question","name":"question","color":"cc317c"},{"url":"https://api.github.com/repos/nodejs/node/labels/vm","name":"vm","color":"bfdadc"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-23T04:51:44Z","updated_at":"2015-08-23T16:53:56Z","closed_at":"2015-08-23T11:20:55Z","body":"> I decided to port this over from [stackoverflow](http://stackoverflow.com/questions/32163206/changing-a-global-variable-through-module-with-vm) because it's so specific to node & vm.\r\n\r\nThe code below uses the native node `vm` library, which allows you to evaluate javascript strings in different contexts.\r\n\r\nThe particular code within `example.js` there's a javascript string that adds a property `.marker` with the value `true` to the `Array` global variable, then requires a file `global.js` (seen below), then logs `Array.marker`. The code below logs `true`.\r\n\r\n    var vm = require('vm')\r\n    \r\n    var code = [\r\n      'Array.marker = true',\r\n      \"require('./global.js')\",\r\n      'console.log(Array.marker)', // => true\r\n    ].join('\\n')\r\n    \r\n    var script = new vm.Script(code, { filename: 'example.js' })\r\n    \r\n    script.runInNewContext({\r\n      'require': require,\r\n      'console': console\r\n    })\r\n\r\nBelow is the contents of `global.js`, which is a simple module that changes the value of `Array.marker` to `false`. \r\n\r\n    var hi = function () {\r\n      Array.marker = false\r\n    }\r\n    module.exports = hi()\r\n\r\nWhat should be happening here is that the code within the `vm` should be setting `Array.marker` to `true` then the `global.js` module should be changing it the value to `false` and it should log `false`. \r\n\r\nIf you go ahead and run the contents of the javascript string outside of `vm`, in it's own file, you will get the expected result, `Array.marker` will be equal to `false`. \r\n\r\n    Array.marker = true\r\n    require('./global.js')\r\n    console.log(Array.marker) // => false\r\n\r\nThe question is: *Why doesn't `Array.marker` get updated to the correct value (`true`)?* *How can I allow the value of `Array.marker` to get updated from within the `global.js` module?*\r\n\r\nIs this an issue with the native node.js `vm` module? Or is this not supposed to be possible? Or are my settings off?"},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/133878392","html_url":"https://github.com/nodejs/node/issues/2503#issuecomment-133878392","issue_url":"https://api.github.com/repos/nodejs/node/issues/2503","id":133878392,"user":{"login":"reggi","id":296798,"avatar_url":"https://avatars.githubusercontent.com/u/296798?v=3","gravatar_id":"","url":"https://api.github.com/users/reggi","html_url":"https://github.com/reggi","followers_url":"https://api.github.com/users/reggi/followers","following_url":"https://api.github.com/users/reggi/following{/other_user}","gists_url":"https://api.github.com/users/reggi/gists{/gist_id}","starred_url":"https://api.github.com/users/reggi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reggi/subscriptions","organizations_url":"https://api.github.com/users/reggi/orgs","repos_url":"https://api.github.com/users/reggi/repos","events_url":"https://api.github.com/users/reggi/events{/privacy}","received_events_url":"https://api.github.com/users/reggi/received_events","type":"User","site_admin":false},"created_at":"2015-08-23T16:53:55Z","updated_at":"2015-08-23T16:53:55Z","body":"@bnoordhuis What your telling me is great, info and context. Yes `vm` is based on v8 / chrome but `require` is a Node.js construct. Node adds require to a file's scope. I need a way of treating the vm as a file and allowing it to require within it's own scope. Is there a drop in replacement for require? \r\n\r\nHowever I'm not alone in wanting to use `require` within a vm. Here @isaacs  [adds `require` to the sandbox as well](https://groups.google.com/forum/#!topic/nodejs/vFkaH8gouDU).\r\n\r\n> The purpose of the vm module is to create a new v8 virtual machine that can be used for any purpose, especially sandboxing code.  If `require()` is exposed by default, then your sandbox has landmines.If you want, you can expose stuff to the vm context like this:\r\n\r\n```js\r\nvar vm = require('vm')\r\nvar ret = vm.createScript('typeof require', 'sandbox.vm').runInNewContext({require:require})\r\n```\r\n\r\nPassing in require like this is really bad because it leaks variables. There has to be a better way. I agree with @isaacs it shouldn't be default, however perhaps an optional flag for the vm to have it's own instance of require."}}