Received: by 10.66.81.170 with SMTP id b10mr859009pay.31.1349514714986; Sat, 06 Oct 2012 02:11:54 -0700 (PDT) Received: by 10.68.242.37 with SMTP id wn5mr3800334pbc.4.1349514714612; Sat, 06 Oct 2012 02:11:54 -0700 (PDT) Path: t10ni23613332pbh.0!nntp.google.com!kt20no11868071pbb.1!postnews.google.com!glegroupsg2000goo.googlegroups.com!not-for-mail Newsgroups: comp.lang.python Date: Sat, 6 Oct 2012 02:11:54 -0700 (PDT) In-Reply-To: Complaints-To: groups-abuse@google.com Injection-Info: glegroupsg2000goo.googlegroups.com; posting-host=122.167.240.170; posting-account=uPFZNQoAAAAm9w7z13q1SjWNKNjztdcD NNTP-Posting-Host: 122.167.240.170 References: User-Agent: G2/1.0 MIME-Version: 1.0 Message-ID: <90140a07-b532-4de7-b764-233d1bb487b4@googlegroups.com> Subject: Re: Executing untrusted scripts in a sandboxed environment From: Ramchandra Apte Cc: python-l...@python.org Injection-Date: Sat, 06 Oct 2012 09:11:54 +0000 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On Saturday, 6 October 2012 04:00:08 UTC+5:30, Robin Krahl wrote: > Hi all, >=20 > I need to execute untrusted scripts in my Python application. To avoid se= curity issues, I want to use a sandboxed environment. This means that the s= cript authors have no access to the file system. They may only access objec= ts, modules and classes that are "flagged" or "approved" for scripting. >=20 > I read that I will not be able to do this with Python scripts. (See Sandb= oxedPython page in the Python wiki [0] and several SE.com questions, e. g. = [1].) So my question is: What is the best way to "embed" a script engine in= a sandboxed environment that has access to the Python modules and classes = that I provide? >=20 > Thanks for your help. >=20 > Best regards, > Robin >=20 > [0] http://wiki.python.org/moin/SandboxedPython > [1] http://stackoverflow.com/questions/3068139/how-can-i-sandbox-python-i= n-pure-python From http://wiki.python.org/moin/SandboxedPython "The Java and CLR/.NET runtimes support restricted execution, and these can= be utilised through the Jython and IronPython variants of Python (as well = as by other languages, obviously)." You can also check out http://doc.pypy.org/en/latest/sandbox.html for PyPy'= s sandbox