new sandbox

package-lock.json

@@ -2144,11 +2144,6 @@
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.1.tgz",
       "integrity": "sha512-kKvNJn6Mm93gAczWVJg7wH+wGYWNrDHdWvpUmHyEsgCtIwwo3bqPtV4tR5tuPaUhTOo/kvhVwd8XwwOllGYkbg=="
     },
-    "safe-eval": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/safe-eval/-/safe-eval-0.3.0.tgz",
-      "integrity": "sha1-Bs4RHuvZwYWrr/AI7A/P/Fxb4Aw="
-    },
     "semver": {
       "version": "5.4.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-5.4.1.tgz",

package.json

@@ -14,7 +14,6 @@
   "dependencies": {
     "node-telegram-bot-api": "^0.29.0",
     "nodejs-mysql": "^0.1.3",
-    "safe-eval": "^0.3.0",
     "winston": "^2.4.0",
     "youtube-dl": "^1.12.2"
   },

src/bot.js

@@ -1,7 +1,7 @@
 import { logger } from "./inc/log.js";
 import { read } from "./inc/cfg.js";
 import { wrapper, clients } from "./inc/wrapper.js";
-const safeEval = require("safe-eval");
+const vm = require("vm");
 
 read().then(() => {
   let bot = new wrapper();
@@ -14,20 +14,16 @@ read().then(() => {
 
     if (e.message.match(/^\.js /)) { // JS-Sandbox
       args = e.message.substring(3);
-      var context = {
+      const context = {
         e: e,
-        gf: "nogf",
-        c: clients,
-        console: {
-          log: console.log
-        }
+        c: clients
       };
       try {
-        var output = safeEval(args, context);
-        if (typeof output !== undefined && output !== "undefined" && output) {
-          let blah = JSON.stringify(output);
-          if (blah != "Converting circular structure to JSON") {
-            e.reply(blah.length > 400 ? `holy fuck, Ausgabe wäre viel zu lang! (${blah.length} Zeichen :DDDDDD)` : blah);
+        let output = vm.runInNewContext(args, context);
+        if(typeof output !== undefined && output) {
+          output = JSON.stringify(output);
+          if (output !== "Converting circular structure to JSON") {
+            e.reply(output.length > 400 ? `holy fuck, Ausgabe wäre viel zu lang! (${output.length} Zeichen :DDDDDD)` : output);
           }
         }
       }