child_process.exec or fetch.npm module in your existing Node or browser app.Warning The code above needs to be the first thing your app runs when it boots so that Sandworm can adequately set up API interception and enforcement can begin if needed. If you load other modules or execute other code before this, you're no longer safe, as others will have had the opportunity to bypass Sandworm's process at that point.
Note You can only callinitonce per your app's lifecycle.
Note Only your app's code (at therootmodule level) will be allowed to callinit.
permissions array to Sandworm.init:devMode config to reflect your environment by using env vars or any other available signal;module name and a permissions array of strings corresponding to the allowed methods.SandwormError. Besides the message attribute, this error object also includes more details about the event:module: the invoking module name or pathmethod: the invoked method (e.g. fs.readFile)SandwormError, while recommended, will not always work. To make sure your app code gets notified about every unauthorized execution, use the onAccessDenied configuration option to register a callback method that will always be triggered right before Sandworm throws, and passed the SandwormError object as an argument.permissions config option should be an array of permission descriptor objects with the following structure:module property that can be either a string (matching a caller path exactly) or a RegExp (not recommended - see "Matching caller paths with RegEx" below).permissions property that can either be a boolean value (representing access to the entire library of supported methods) or an array of granular string permissions, representing individual supported methods (like Storage.setItem or Fetch.fetch).Note If thepermissionspassed to Sandworm do not contain an explicit descriptor for therootmodule (your app code), it will be given all permissions by default (by appending{module: 'root', permissions: true}to the passed list). You can override this behavior and grant only specific, explicit permissions for the root module, just like for any other modules in your app, by passing a descriptor withmodule: 'root'.
Note In dev mode, all modules are granted all permissions, and any passedpermissionsconfig is ignored.
Note This mainly applies to setting up permissions for the root module. For most use cases, you should avoid granting global permissions to a module call path to comply with PoLP. The default root permission descriptor is{ module: 'root', permissions: true }.
permissions: true within a module descriptor will give that module (or call path) permissions to invoke any Sandworm-supported method except for a set of particularly unsafe ones that allow for arbitrary code execution - like eval or vm.runInContext. Using these methods carries a considerable security risk and should generally be avoided. Rigorously audit the code of a module that uses these before using it in your app.permissions from true to ['eval.eval', '*'] to acknowledge that you accept this high-risk configuration.require uses several fs methods as well as vm.compileFunction;https.require uses dns.lookup and tls.Socket.bind Callsmethod.bind whenever it is called with more than one argument. The reason behind this is that using bind to partially apply arguments creates contained methods that can then float around until they get executed by another module. For example:test-libB, which depends on a method from a separate module, test-libA, which in turn ends up using axios to make an HTTP request. Internally, axios uses the follow-redirects module as a drop-in replacement for Node's http and https modules that automatically follows redirects. In this case, you should expect to see the following module name requesting to use the https.request permission:test-libB module. But this would enable any of test-libB's dependencies to piggyback on this permission to execute malicious calls.follow-redirects, but then we are effectively enabling any module in our app to use it for making any requests, including potentially malicious ones.module property also accepts a RegExp to match multiple module names. Here's a real-world example taken from our automated tests using Jest:react-dom module usually sits at the bottom of the module hierarchy and is responsible for triggering most method calls. To specify trusted modules, use the trustedModules configuration option.Note When specifying a trusted module, you effectively permit it to impersonate root. Use this configuration carefully.
<script> tag as individual modules. This is why, for example, you might see https://googletagmanager.com invoking Beacon.sendBeacon whenever your app sends analytics data. To modify this behavior:trustedModules config array, orloadSourceMaps config option.ignoreExtensions config option to false. By default (ignoreExtensions: true), any invoke that has a browser extension anywhere in the call path will be passed through.aliases config option to an array of objects having:path attribute, representing a path component shared between all source code files that should be matched by the alias;name attribute, representing the alias name to apply.loadSourceMapstrue in browsers false in NodedevModefalseverbosefalsewarn; setting this to true lowers the level to debug.skipTrackingfalsetrackingIP127.0.0.1trackingPort7071ignoreExtensionstruetrustedModules[]permissions[]onAccessDeniedundefinedNote When loading sourcemaps,Sandworm.initbecomes an async method you need toawait. It is best to wait for it to finish before importing other modules or further initializing your app. Until then, Sandworm will not be able to correctly infer module names, potentially leading to legitimate calls being blocked.
loadSourceMaps=true to Sandworm.init. Setting this option to true will load the sourcemap defined within the currently executing js file (containing the init-invoking code).NoteloadSourceMapsis true by default when running Sandworm in a browser.
init) will be treated as entirely individual modules. To signal you need multiple code files, pass an object to the loadSourceMaps option with source paths (or URLs) as keys and sourcemap paths (or URLs) as values:--no-telemetry option. You can also audit what's getting sent and the server code.tests/node directory.tests/web directory.tests/unit directory.