Node.JS vm.runInNewContext() vs require() and eval()

Question

• Is vm.runInNewContext considered black magic like eval?
• Is there a significant performance difference between require and reading a file and using vm to run it or is the the same under the hood (if you implemented caching etc and just wanted to add some variables to the context)

Answer 1

If you check out the code that implements loading Modules in node.js, you'll see that require uses vm.runInNewContext or vm.runInThisContext under the hood. The require however, does some other extra things, like caching the module.

The node documentation shows how the behavior is similar and different between the vm commands and eval.

So, require, eval and vm are all a little bit different, but all can be used to load code. They all have similar security issues if you are loading arbitrary code that comes from the client.