How to completely remove a nodejs module with all its functionalities even including setInterval?

Question

I am developing an IDE that enables developers to develop express.js applications. So, developers can create new express applications. Since resource consumption is vital, I do not want to run each express app in a separate process; actually they are all running in the main process as node.js modules. Now the problem is I do not have any idea what codes developers will write, for example whether they use functions like setInterval or not. Let me explain a little bit more:

Suppose this is the main program:

'use strict'

const mainApp = require('express')();

require('./userModule.js')();

mainApp.delete('/', function(req, res){
  /*
    What should I do here to delete the user code?
  */
  res.status(202).send('deleted');
});

mainApp.listen(8000, () => console.log('Example app listening on port 8000!'))

And this is the code written by user in userModule.js function:

'use strict'

module.exports = function(){

  // code written by user will come below

  setInterval(function(){
    console.log('hello!!!');
  }, 3000);

  // code written by user will come above

}

I already know the following:

1- Delete the module cache as explained here. That does not help.

delete require.cache[require.resolve('./userModule.js')];

2- ClearInterval when the ID is unknown as explained here. I do not want to clear all intervals! Moreover, it only works for setInterval function, what about others?!!!

I am reaching a point that there is no option if the module is running in the main process. Am i right?

score 1 · Accepted Answer · answered Nov 20 '17 at 13:02

And don't forget that they may well set global variables by assigning to global (global.foo = 42 or similar). And once a global is created, you have no idea who created it and whether it should be removed.

Yes, you're correct that you can't fully clean up a Node module.

Absolutely, positively, do not run them all in the same process.

Even if you're spawning them as separate processes, unless you absolutely trust each and every author, you can't just run the code they give you. You'll need to do a lot more to protect yourself (chroot jails, that kind of thing). The full list of things you'll need to do to protect yourself is far too broad for an SO question/answer.

But again the basic answer is: Yes, you're correct, you cannot fully clean up a Node module once loaded. Don't load their code into your process.

How to completely remove a nodejs module with all its functionalities even including setInterval?

1 Answers1