Use the isolated-vm library to lock down further the image in which JavaScript is run in the evaluator
Open, Needs TriagePublic
Actions

Assigned To

None

Authored By

	Bugreporter
	Aug 8 2023, 3:32 PM

Description

See https://github.com/laverdet/isolated-vm.

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Jdforrester-WMF	T343817 Investigate additional ways of locking down language-specific execution for the function-executor
		Open		None	T343821 Use the isolated-vm library to lock down further the image in which JavaScript is run in the evaluator

Event Timeline

Bugreporter created this task.Aug 8 2023, 3:32 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 8 2023, 3:32 PM

Bugreporter edited projects, added Abstract Wikipedia team; removed WikiLambda.Aug 8 2023, 3:32 PM

Note previously https://github.com/patriksimek/vm2 is widely used but is abandoned due to security issues discovered.

Bugreporter mentioned this in T343817: Investigate additional ways of locking down language-specific execution for the function-executor.Aug 8 2023, 4:28 PM

Jdforrester-WMF renamed this task from Run JavaScript code in an isolated-vm to Use the isolated-vm library to lock down further the image in which JavaScript is run in the evaluator.Aug 8 2023, 4:31 PM

Jdforrester-WMF added a project: function-evaluator.

sbassett added a parent task: T343817: Investigate additional ways of locking down language-specific execution for the function-executor.Aug 8 2023, 4:35 PM

LennardHofmann subscribed.Aug 11 2023, 8:18 AM

akosiaris subscribed.Sep 5 2023, 2:17 PM

Jdforrester-WMF moved this task from To triage to No current plans / External on the Abstract Wikipedia team board.Sep 21 2023, 4:39 PM

Use the isolated-vm library to lock down further the image in which JavaScript is run in the evaluatorOpen, Needs TriagePublicActions

Description

Related ObjectsSearch...

Event Timeline

Use the isolated-vm library to lock down further the image in which JavaScript is run in the evaluator
Open, Needs TriagePublic
Actions

Related Objects
Search...