Harden VM context disable codegen and avoid leaking host console

.changeset/vm-hardening.md

@@ -0,0 +1,6 @@
+---
+"@workflow/core": patch
+---
+
+Harden the VM context by disabling dynamic code generation (eval/new Function/WebAssembly) and preventing leakage of the host console into the VM realm.
+

packages/core/src/vm/index.ts

@@ -19,8 +19,16 @@ export function createContext(options: CreateContextOptions) {
   let { fixedTimestamp } = options;
   const { seed } = options;
   const rng = seedrandom(seed);
-  const context = vmCreateContext();
-
+  const context = vmCreateContext(undefined, {
+    // Hardening: block dynamic code generation inside the VM realm via:
+    // - eval("..."), new Function("..."), etc.
+    // NOTE: `node:vm` is not a security sandbox. This reduces common escape primitives
+    // when executed code is attacker-controlled.
+    codeGeneration: {
+      strings: false,
+      wasm: false,
+    },
+  });
   const g: typeof globalThis = runInContext('globalThis', context);
 
   // Deterministic `Math.random()`
@@ -93,7 +101,19 @@ export function createContext(options: CreateContextOptions) {
   g.Headers = globalThis.Headers;
   g.TextEncoder = globalThis.TextEncoder;
   g.TextDecoder = globalThis.TextDecoder;
-  g.console = globalThis.console;
+  // Do NOT leak the host console object into the VM realm by reference.
+  // Provide a minimal VM-local console stub instead.
+  const vmConsole = runInContext(
+    `({
+    log(){},
+    info(){},
+    warn(){},
+    error(){},
+    debug(){},
+  })`,
+    context
+  );
+  (g as any).console = vmConsole;
   g.URL = globalThis.URL;
   g.URLSearchParams = globalThis.URLSearchParams;
   g.structuredClone = globalThis.structuredClone;

packages/core/src/vm/vm-hardening.test.ts

@@ -0,0 +1,31 @@
+import { runInContext } from 'node:vm';
+import { describe, expect, it } from 'vitest';
+import { createContext } from './index.js';
+
+describe('VM hardening (non-weaponized regression tests)', () => {
+  it('disallows eval and Function constructor inside the VM realm', () => {
+    const { context } = createContext({ seed: 'poc-seed', fixedTimestamp: 0 });
+
+    const res = runInContext(
+      `
+      (function(){
+        const out = {};
+        try { eval("1"); out.eval = "allowed"; } catch { out.eval = "blocked"; }
+        try { new Function("return 1")(); out.fn = "allowed"; } catch { out.fn = "blocked"; }
+        return out;
+      })()
+    `,
+      context
+    );
+
+    expect(res).toEqual({ eval: 'blocked', fn: 'blocked' });
+  });
+
+  it('does not expose the host console object by reference', () => {
+    const { globalThis: g } = createContext({
+      seed: 'poc-seed',
+      fixedTimestamp: 0,
+    });
+    expect(g.console).not.toBe(console);
+  });
+});

packages/core/src/workflow.ts

@@ -592,11 +592,6 @@ export async function runWorkflow(
       }
     }
     vmGlobalThis.TransformStream = TransformStream;
-
-    // Eventually we'll probably want to provide our own `console` object,
-    // but for now we'll just expose the global one.
-    vmGlobalThis.console = globalThis.console;
-
     // HACK: propagate symbol needed for AI gateway usage
     const SYMBOL_FOR_REQ_CONTEXT = Symbol.for('@vercel/request-context');
     // @ts-expect-error - `@types/node` says symbol is not valid, but it does work