allowing use of require() in tasks about node-workflow

[kusor]

Honestly, I don't think it's a good idea to allow the use of require from tasks: what is the reason to do not require those modules in advance using wf-runner configuration?

Not to mention that we would be moving from "dangerous" to "completely unsafe" in terms of executing completely arbitrary code from vm.

[TomKaltz]

I would like to be able to reuse code and reduce boilerplate in my tasks. As far as security, I don't understand how this is any less safe. Your database and file system already hold 'arbitrary' code that is run anyway. We just don't have the option to require arbitrary files for our arbitrary code. Not sure how sandboxing in this case makes anything any safer. I don't understand where malicious injection would occur otherwise.

[kusor]

@TomKaltz allowing a task to use require means that it could also require things like fs and, for example, fork a child process, which could mess pretty much everything regarding how wf-runner work.

Anyway, I wouldn't be opposed to add a configurable option to use require and have it disabled by default with that disclaimer you mentioned