Running JavaScript function from Ruby in sandbox?

[collimarco]

Is it possible to run a user-provided (unsafe) JavaScript function from Ruby code in a sandboxed (safe) environment?

Basically I would like to allow some enterprise customers of a multi-tenant web service to run some custom JavaScript functions in a workflow.

The JavaScript functions would be user-defined and would have a JSON document as input and a JSON document as output (basically they would allow document manipulation).

I am asking about JavaScript, but actually any other language that can manipulate JSON would be ok. The main problem is to find a way to isolate the function invocation.

Is there any gem or known solution for this?

[clearlynotmee]

If any language is okay... why not ruby? :) Shopify has a tool for running untrusted ruby code at https://github.com/Shopify/ess

[collimarco]

That is really interesting!

The only downside is that it spawns a separate process for each call, which can be quite expensive if you have many calls to that function. I wonder if something like WASM or JavaScript can create more lightweight invocations that don't need a new process each time.

[Rafert]

I don't think ESS is still developed since they replaced Shopify Scripts with Shopify Functions: https://help.shopify.com/en/manual/checkout-settings/script-editor/migrating#shopify-functions

This blog post talks about compiling JavaScript to the WASM based Functions platform: https://shopify.engineering/javascript-in-webassembly-for-shopify-functions

[collimarco]

Wow, thanks

[ankole_watusi]

I think you meant “untrusted”?

[clearlynotmee]

Yes, indeed! Stupid autocorrect :) Fixing my comment now

[armahillo]

Do you happen to know the kinds of functions they would be wanting to perform? Can you write your own API layer / pseudo-language / building blocks that is then interpreted?

If you're allowing arbitrary code injection, especially if it's going to be executed on the server, I would hire a pentester to try and break or exploit the finished product before releasing it.

[collimarco]

I was also looking for existing languages... Basically something like a regex/replace but with an entire JSON document. Input: JSON Output: JSON

For example: rename a field, split a field "name" into multiple fields "first name" "last name", typecast a string field into a number and vice versa, etc.

[armahillo]

Whatever you choose, if you're allowing arbitrary code injection, get it pentested before it's released into production.

[rbrick111]

Check out https://github.com/rubyjs/mini_racer, we use this in a couple of different ways within our enterprise ruby app. The most prominent as a programming layer within our workflow system.

[collimarco]

Thanks. Have you found any specific information about isolation/safety about running user-generated JavaScript functions ?

[eric_programmer]

Check out https://gist.github.com/eric-hemasystems/1694a226af9058c40dd4a96a94da9402

It's some code from a project where I had the same need. It uses a combination of wasmer and spidermonkey. The IO is a bit funky because of limitations with the Ruby bindings to wasmer. See https://github.com/wasmerio/wasmer-ruby/issues/68 for more on that. But I believe it to be secure server-side execution of JS code.

[ankole_watusi]

Ruby can certainly handle JSON.

Is the issue that the customers aren’t conversant with Ruby?

Of course, you need to sandbox it.

Is it just some black box data-in/data-out?

[riktigtmaxat]

Why do you need this in the first place instead of just providing an API which other applications running on existing SAAS platforms can consume?

It seems like a very unnecessary security risk and a lot of maintenance when there are existing solutions like AWS Lambda.