Cap execution timeout at 5 minutes

CHANGELOG.yaml

@@ -1,3 +1,7 @@
+master:
+  new features:
+    - GH-509 Added a limit to the maximum allowed script execution timeout
+
 3.5.1:
   date: 2019-11-13
   chores:

lib/index.js

@@ -6,6 +6,7 @@ var _ = require('lodash'),
     teleportJS = require('teleport-javascript'),
     bootcode = require('./bootcode'),
 
+    MAX_EXECUTION_TIMEOUT = 5 * 60 * 1000, // 5 minutes
     TO_WAITBUFFER = 500, // time to wait for sandbox to delcare timeout
     EXECUTION_TIMEOUT_ERROR_MESSAGE = 'sandbox not responding',
     BRIDGE_DISCONNECTING_ERROR_MESSAGE = 'sandbox: execution interrupted, bridge disconnecting.',
@@ -17,8 +18,14 @@ PostmanSandbox = function PostmanSandbox (options, callback) {
     this.executing = {};
     this.debug = Boolean(options.debug);
 
-    // set the dispatch timeout of UVM based on what is set in options unless original options sends the same
-    _.isFinite(options.timeout) && (options.dispatchTimeout = this.executionTimeout = options.timeout);
+    if (_.isFinite(options.timeout)) {
+        // cap timeout value to the allowed maximum timeout
+        options.timeout > MAX_EXECUTION_TIMEOUT && (options.timeout = MAX_EXECUTION_TIMEOUT);
+
+        // set the dispatch timeout of UVM based on what is set in options
+        // unless original options sends the same
+        options.dispatchTimeout = this.executionTimeout = options.timeout;
+    }
 
     UniversalVM.call(this, options, function (err, context) {
         if (err) { return callback(err); }

test/unit/sandbox-timeout.test.js

@@ -45,6 +45,16 @@
         });
     });
 
+    it('should not allow setting timeout more that a limit', function (done) {
+        Sandbox.createContext({
+            timeout: 10 * 60 * 1000 // 10 minutes
+        }, function (err, ctx) {
+            expect(err).to.not.exist;
+            expect(ctx.executionTimeout).to.equal(5 * 60 * 1000); // 5 minutes
+            done();
+        });
+    });
+
     it('should clear timeout on bridge disconnect', function (done) {
         Sandbox.createContext({
             debug: true,