4

I'm looking for a python3 library (or project) that can allow me to run "unsafe" code (input from the internet, or similar) without compromising security.

If such a library doesn't exist, a recommendation for a programming language that I could "bind" (I'm not sure of the exact term, "host" maybe?) would also be acceptable (though I would like the solution to be as simple as possible).

For clarity, I'm not talking about "hosting" unsafe python code in python, which a few questions I have found here and on SO tell me is impossible. I would also like to avoid creating a DSL, because I want to support a lot of the features of a "modern" high-level programming language (algebraic expressions, list manipulation, class/function definition).

My specific requirements (roughly in order of importance):

  • Ability to pass "complex" data structures between the python host and the unsafe code. Ideally as much complexity as (for example) JSON would be supported, although I could probably manage with a bit less. Only being able to pass basic data types (int, string) would not work well.

  • The language the unsafe code is written in providing support for the language features mentioned above

  • Ability to call functions defined by the unsafe code from python (by name)

  • (Less important) ability for the unsafe code to call a function defined in the python code (safely)

  • (Optional) language for the unsafe code being simple and easy to learn

Some of the things that I've looked at are:

  • Python: as mentioned, it seems (nearly?) impossible to safely run unknown/untrusted python code. But I've seen some mentions that PyPy offers a restricted sandbox, or the RestrictedPython project. I'm not sure if these are considered safe or if they work for python3.

  • Javascript: via a library like PyV8 or PyExecJs. I haven't found anything about whether running code this way is actually "safe", but this seems like it could be a good solution. I'm also not sure if there's a better maintained equivalent to these.

An answer that what I'm looking for doesn't exist for python is also reasonable (though a pointer to a language/library solution where this is possible would be nice, in that case).

Improve this question
2
  • I struggled a bit with adding tags to this, so please feel free to edit more relevant tags in if you feel necessary (or let me know and I will edit them in)
    – mbrig
    May 30, 2017 at 5:00
  • Such functionality is called SandBox, there is no such tag here. So it is a tip that you can use to search over the internet.
    – Jorge Campos
    Jun 6, 2017 at 14:01

1 Answer 1

Reset to default
3

Your use of "safe", "security", and "unsafe" is somewhat vague. But if by security compromising code you are pointing to functionalities that interact with your system's files, processes, configurations, networks, and alike, and if you only need the code to do in-memory computation and finally pass the data back to another(hosted) trusted program(process), then:
you can get the python's source code, remove(replace) every ABI related to system manipulation and then compile. At the end, you will end up with a customized version of Python engine library that will throw an error if a code wants to do something other than in-memory computation

Note0: It's harder than it seems.

Note1: You can also do this with Lua, its standard library is significantly smaller than Python, so its easier to edit.

Note2: I couldn't decide if this count as a software recommendation, so feel free to edit/remove it. But at least, this is what a library should be like if it's implementing a safe run-time environment

Improve this answer
2
  • Thank you for the answer. Definitely a tough proposition: I heard (but can't confirm) cpython is >1M lines of code. And I think its not just file system interaction, the creation of arbitrary bytecode objects would probably also be a problem. I'm currently leaning more towards a javascript solution: JS is at least expected to be sandboxed securely, even if it seems python might not be the best language to do it in.
    – mbrig
    Jun 9, 2017 at 4:44
  • Sure. Yeah I forgot all about executable memory. Also it's still part of the underlying OS' API. But at the end, nothing is perfect. Just define the limits you want to impose, and choose based on that. Hope you'll update this post with your findings.
    – psychob
    Jun 10, 2017 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.