This Sandcastle module ( bcoe/sandcastle) seems to aim to do what I have in mind.

Is it a mistake to try and do this server-side?ĮDIT: It's not important that the user be able to leverage the full capabilities of JavaScript, in fact it would be preferable to be able to pick and choose which APIs would be provided to the user code.ĮDIT: I am going to go ahead and update with what I found. Is there a standard way to sandbox and execute non-trusted JavaScript in Node, getting the output.

I have seen some projects like Microsoft Web Sandbox and Google Caja which allow execution of sanitized markup and script (for embedding third-party ads on websites), but it seems that these are client-side tools and I'm not sure if they can be safely used within Node. The eval function comes to mind, but I know this has multiple security concerns (the user submitted code would be able to access Node's File API, etc). I would like to have the ability to let users submit arbitrary JavaScript code, which is then sent to a Node.JS server and safely executed before the output is sent back to multiple clients (as JSON).

Sandboxie github