Running Client Code on Nodejs in Sandbox
<p>I want clients to be able to send scripts that will be ran on the server. The scripts will be looked by the admins before being ran but I want to prevent disasters if an exploit is not seen.</p>

<p>The client should only be able to use the functions defined by an API. My strategy was to create use <code>vm</code> to create a new context with only access to the <code>api</code>.</p>

<pre><code>var vm = require('vm');

var v = 0; //incremetable via API

var api = {
    incr:function(){
        v++;
    }
}

var userCode =
`(function(api){
    api.incr();
    process.exit();     //ERROR: process is undefined
 })`;

vm.runInNewContext(userCode)(api);

console.log(v);
</code></pre>

<hr>

<p>In theory, it looks fine. However, it turns out that you can still crash the server via</p>

<p><code>api.incr.constructor("return this")().process.exit(1)</code></p>

<hr>

<p>How could I offer an API (aka capacity of the script to alter the main context) without compromising my server?</p>

<p>Something similar to <code>iframe</code> in the browser.</p>