Node.JS vm.runInNewContext() vs require() and eval()

Question

• Is vm.runInNewContext considered black magic like eval?
• Is there a significant performance difference between require and reading a file and using vm to run it or is the the same under the hood (if you implemented caching etc and just wanted to add some variables to the context)

Answer 1

runInNewContext is not meant to be used as a replacement of require or eval, but instead as a way to create a sandbox environment where you can safely run other scripts.

Disadvantages are that it's slow (creation takes ~10 ms.) and takes up a couple megabytes. So no, don't use it as a require replacement.

Answer 2

If you check out the code that implements loading Modules in node.js, you'll see that require uses vm.runInNewContext or vm.runInThisContext under the hood. The require however, does some other extra things, like caching the module.

The node documentation shows how the behavior is similar and different between the vm commands and eval.

So, require, eval and vm are all a little bit different, but all can be used to load code. They all have similar security issues if you are loading arbitrary code that comes from the client.