node.js - How can I safely interpolate with Node.js?

Question

I'm looking for a way to safely interpolate. What I want to do is as follows;

They have type schemas for my business objects and I make them perform database operations correctly with these schemas. But the problem is that when interpolating a security hole occurs. How can I solve this problem? Do you have a better idea?

https://replit.com/@aarican/Interpolate

class Utils {
    static interpolate(template, scope) {
        return (new Function(Object.keys(scope), "return " + template))(...Object.values(scope));
    }
}

const docTypeJSON = {
   name: 'user',
   displayName: '$doc.firstName + " " + $doc.lastName',
   properties: [
     {
         name: 'firstName',
         type: 'string'
     },
     {
         name: 'lastName',
         type: 'string'
     }
   ]
}


const doc = {
    firstName: 'Ayhan',
    lastName: 'ARICAN',

    get displayName () {
        return Utils.interpolate(docTypeJSON.displayName, { $doc: this }).toString()
    }
}

console.log(doc.displayName)

docTypeJSON.displayName = 'require("child_process").execSync("ls -la")'

console.log(doc.displayName)

标签： node.jsstring-interpolation