Re^3: embedding a safe unescapable mini perl interpreter?

[RichardK]

Well theoretically any Turing complete language is going to be a problem, as it cannot be proved to be secure.

There's a really interesting presentation about these issues here http://boingboing.net/2011/12/28/linguistics-turing-completene.html It's a keynote speech at the 28th Chaos Computer Congress (28C3) by Meredith Patterson on "The Science of Insecurity". I highly recommend it, it's definitely worth watching.

So I think you have to write your own language, and only including the functionally that is needed, and keeping it as simple as possible. Parse::RecDescent is a good place to start, it makes working with grammars quite easy :)

The key issue is the complexity of the allowed expressions, if you can keep to a context-free grammar the you might get away with it. But my guess is that you will need to have a human in the loop to check and approve each submission before they go live.

[iaw4]

ok. thanks everybody.

it looks like this is going to be a lot more effort than I thought it would be. pity and surprising. there should be a complete set of everything that can 'escape' into the sandbox---backquotes, system(), fopen(), etc.---or, better yet, a complete set of features known not to escape. all I wanted is a clear subset with string manipulation, numerical functions, STDOUT, and basic variables, and a set of functions I would enumerate as 'safe'. if that had existed, I could have sanitized the first user input, and then passed it to 'eval'. it may still be simpler to do this than to write my own little language.

next, I will check out SafeEval, as described in http://www.daniweb.com/software-development/perl/code/216821

[Anonymous Monk]

...

Funny :) I don't get it :)

What is the problem with using Template (without EVAL_PERL) or Inline::Lua? Or javascript (with http://www.adsafe.org/ )?

Have you heard of Safe, Safe::Hole?