Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #106618

Re: Untrusted code execution

From Paul Rubin <no.email@nospam.invalid>
Newsgroups comp.lang.python
Subject Re: Untrusted code execution
Date 2016-04-07 00:08 -0700
Organization A noiseless patient Spider
Message-ID <87inztq4k0.fsf@nightsong.com> (permalink)
References <slrnng31v9.19u.jon+usenet@wintry.unequivocal.co.uk> <slrnng7gj4.19u.jon+usenet@wintry.unequivocal.co.uk> <87r3ejpz6o.fsf@nightsong.com> <slrnng8aq5.19u.jon+usenet@wintry.unequivocal.co.uk>

Show all headers | View raw

Jon Ribbens <jon+usenet@unequivocal.co.uk> writes:
>> That string decodes to "__private".
> Yes, and? ... The namespace
> I was suggesting didn't provide access to any objects which have a
> 'get()' method which would access attributes.

I see, I forgot that getattr is a function, not an object method.
Though, now you've got the problem that there isn't enough capability
left to do much interesting.  I used web.py for a while, that had a
complete interpeter for a sandboxed Python-like language written in
Python itself.  That's a brutal way to deal with the problem, and it had
annoyances, but it seemed to work.  You presumably also want to limit
CPU usage etc.  

Geordi (the C++ irc bot) now just launches the user script in a Docker
container, I think.  Before that it had some fancier sandboxing
approaches.

Lua is supposed to be easy to embed and sandbox.  It might be
interesting to write Python bindings for the Lua interpreter sometime.

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-03 21:12 +0000
  Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 13:46 +0000
    Re: Untrusted code execution Rustom Mody <rustompmody@gmail.com> - 2016-04-05 07:17 -0700
      Re: Untrusted code execution Ian Kelly <ian.g.kelly@gmail.com> - 2016-04-05 08:50 -0600
      Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 17:26 +0000
        Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 18:50 +0000
          Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 19:14 +0000
        Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 19:13 +0000
        Re: Untrusted code execution Steven D'Aprano <steve@pearwood.info> - 2016-04-06 11:43 +1000
          Re: Untrusted code execution Random832 <random832@fastmail.com> - 2016-04-06 09:14 -0400
            Re: Untrusted code execution Steven D'Aprano <steve@pearwood.info> - 2016-04-07 11:45 +1000
              Re: Untrusted code execution Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2016-04-07 14:48 +1000
              Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-07 15:18 +0000
                Re: Untrusted code execution Steven D'Aprano <steve@pearwood.info> - 2016-04-08 15:28 +1000
          Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-07 12:13 +0000
            Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-07 14:25 +0000
              Re: Untrusted code execution Steven D'Aprano <steve@pearwood.info> - 2016-04-08 15:26 +1000
            Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-07 17:20 +0000
              Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-07 17:35 +0000
              Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-10 17:06 +0000
      Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 17:40 +0000
    Re: Untrusted code execution Paul Rubin <no.email@nospam.invalid> - 2016-04-05 13:39 -0700
      Re: Untrusted code execution Jon Ribbens <jon+usenet@unequivocal.co.uk> - 2016-04-05 21:13 +0000
        Re: Untrusted code execution Paul Rubin <no.email@nospam.invalid> - 2016-04-07 00:08 -0700
          Re: Untrusted code execution Lele Gaifax <lele@metapensiero.it> - 2016-04-08 10:10 +0200

csiph-web