Beefy Boxes and Bandwidth Generously Provided by pair Networks Ovid
The stupid question is the question not asked
 
PerlMonks  

Embedded scripting sandbox? Lua?

by cavac (Chaplain)
on Oct 03, 2011 at 14:00 UTC ( #929344=perlquestion: print w/ replies, xml ) Need Help??
cavac has asked for the wisdom of the Perl Monks concerning the following question:

Hi!

I need a little help for my Maplat webserver project: To automate some processes i like to give the user the opportunity to write simple embedded script code. This scripts should be able to do math, string matching and change some given data structures - but nothing more. No file access, no access to the host script (written in perl).

This interpreter would be run within a perl script, get the data structures defined by that script and after the interpreter finished (or timed out) the results would be used in the perl script.

Here's a (rather stupid, i admit) example pseudo code how it could be used in a webmail system:
// Forward mail to private account on weekend if weekday > 5 then email.reciever = "private@example.com" exit; end if email.subject has "TEST" then email.mailbox = "testmails" else if email.sender == "boss@example.com" email.mailbox = "bigboss" else email.mailbox = "trash" end


I looked into Lua::API, but i'm not sure how to safely sandbox that. I read some Lua documentation, but i'm none the wiser...

Any ideas how to do that?

Rene
UPDATE
Managed to translate http://lua-users.org/wiki/SimpleLuaApiExample into a simple Lua::API script.

test.lua:
x = 0 for i = 1, #foo do x = x + foo[i] end return x

test.pl:
use strict; use warnings; use Lua::API; my $L = Lua::API::State->new; my $status = $L->loadfile("test.lua"); if($status) { die "Failed to load file: " . $L->tostring(-1); } $L->newtable; for(my $i = 1; $i <= 5; $i++) { $L->pushnumber($i); $L->pushnumber($i*2); $L->rawset(-3); } $L->setglobal("foo"); my $result = $L->pcall(0, Lua::API::MULTRET, 0); if($result) { die "Failed to execute file: " . $L->tostring(-1); } my $sum = $L->tonumber(-1); print "Script returned $sum\n"; $L->pop(1); $L->close;
This still needs a lot of work though, but i see a (very dim) light at the end of the (very long) tunnel.
Don't use '#ff0000':
use Acme::AutoColor; my $redcolor = RED();
All colors subject to change without notice.

Comment on Embedded scripting sandbox? Lua?
Select or Download Code
Re: Embedded scripting sandbox? Lua?
by afoken (Parson) on Oct 03, 2011 at 18:52 UTC

    Do you know Safe?

    Alexander

    --
    Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
      Frankly, i do not trust the concept. Creating a sandbox within the current interpreter seems kind of risky to me.

      But i'll take it into consideration.
      Don't use '#ff0000':
      use Acme::AutoColor; my $redcolor = RED();
      All colors subject to change without notice.
Re: Embedded scripting sandbox? Lua?
by perlfan (Deacon) on Oct 03, 2011 at 20:04 UTC
    Why not use Perl? Check out the Inline::Foo module example; it'll let you define your own Perl based domain specific "language".
      Thanks, but i'm not trying to inlining code, i want to fetch it from a database, execute it in a sandbox and save the results.
      Don't use '#ff0000':
      use Acme::AutoColor; my $redcolor = RED();
      All colors subject to change without notice.
        You mention Lua, so I think of Inline::Lua. You can also inline inside of an eval. You're creating a dependency on an whole language ecosystem (as lightweight as it is) just to provide scripting inside of a ... scripting language? Your call. Good luck.
Re: Embedded scripting sandbox? Lua?
by Anonymous Monk on Oct 04, 2011 at 06:43 UTC
      I would like to use Lua::API. Got any *documented* examples?

      The POD for Lua::API is quite long but doesn't say anything more than "this is more or less similar to the C API". I can work with that but i was really hoping for a more usefull, meaning something i can use without too much trial and error.

      BTW, forgot to mention: I already did a project where i interfaced to LUA from within C.
      Don't use '#ff0000':
      use Acme::AutoColor; my $redcolor = RED();
      All colors subject to change without notice.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://929344]
Approved by Corion
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others contemplating the Monastery: (9)
As of 2014-04-17 06:46 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    April first is:







    Results (440 votes), past polls