extraMatchObjects() called outside vm sandboxing

[Omikhleia]

In world-object-class-builder.js findNearby(), when extraMatchObjects on a location is a function, it is invoked directly. Since command parsing is done from the game engine and directly invoked from the player object in player-controller.js (via player.matchObjects()), the call is eventually performed outside vm sandboxing.

This is apparently the only case when in-world content is invoked outside the vm.

It seems it cannot break much things, being accessed through the Proxy from world-object-proxy-builder. Yet, it's not fully controlled, e.g. with the timeout other calls and hooks have - So an infinite loop for instance makes CPU going crazy.

This is probably not an easy issue, as matchObjects() may also be called from in-world content.

[doughsay]

I'll take a look at this as part of the 4.0.0 milestone