# vlsandbox

> Scoped Sandbox

Latest version **2.5.4** (published 2022-12-15) · GPL-3.0-only license · 0 weekly downloads

## Install

```sh
npm install vlsandbox
pnpm add vlsandbox
yarn add vlsandbox
bun add vlsandbox
```

## Health

**Score 20/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.5.4 |
| Published | 2022-12-15 |
| First published | 2021-09-20 |
| Weekly downloads | 0 |
| License | GPL-3.0-only |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 1 |
| Unpacked size | 22.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Levi Hechenberger & luucy AG |
| Maintainers | levvij |
| Keywords | sandbox |

## Links

- npm: https://www.npmjs.com/package/vlsandbox
- Repository: https://github.com/vlvtin/vlsandbox
- Homepage: https://github.com/vlvtin/vlsandbox#readme
- Issues: https://github.com/vlvtin/vlsandbox/issues
- npm.io page: https://npm.io/package/vlsandbox

## Dependencies (1)

- [espree](https://npm.io/package/espree.md) ^9.3.2

## Recent versions

- 2.5.4 (latest) — 2022-12-15
- 2.5.3 — 2022-05-16
- 2.5.2 — 2022-05-16
- 2.5.1 — 2021-11-23
- 2.5.0 — 2021-11-16
- 2.4.0 — 2021-10-04
- 2.3.2 — 2021-10-04
- 2.3.1 — 2021-10-04
- 2.3.0 — 2021-10-04
- 2.1.1 — 2021-09-20
- 2.1.0 — 2021-09-20
- 2.0.1 — 2021-09-20
- 2.0.0 — 2021-09-20

## README

[![npm version](http://badge.acryps.com/npm/vlsandbox)](http://badge.acryps.com/go/npm/vlsandbox)

# vlsandbox Scoped Sandbox
Need to run external code (e.g. Plugins) in your application, without exposing `globalThis` object? Try vlsandbox

```
const sandbox = new Sandbox(`
    alert(message);
`);

sandbox.run(); // will throw an error, as alert and message are exposed to the sandbox

sandbox.expose("alert"); // allow access to window.alert
sandbox.expose("message", "Hello World"); // pass custom variable

sandbox.run(); // will show a alert "Hello World"
```

## Security and implications
> Do NOT use this framework as a end-all-be-all solution to encapsulating external code. vlsandbox will not prevent you from exposing a objected containing a window reference! Never expose HTML-Elements to sandboxes!

You can't use the classic function declaration within sandboxes, because `globalThis` can be obtained as demonstrated in this example:
```
console.log(() => this); // will return {} or whatever you passed to run(scope?)
console.log(function() { return this }) // will return globalThis
```

## Sponsoring and support
This project is sponsored and supported by [VLVT.IN GmbH](https://vlvt.in), [luucy AG](https://luucy.ch) and [inter allied crypsis / ACRYPS](https://acryps.com).

---
_Source: https://npm.io/package/vlsandbox · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._