Simple Python Sandbox

[Stephen Hansen]

On 8/14/10 4:24 PM, Roland Koebler wrote:
> You can find some documentation at
> http://simple-is-better.org/template/pyratemp.html#evaluation,
> and the pseudo-sandbox itself in my template-engine, class
> "EvalPseudoSandbox" on the website above.
> (Please write me if you have any comments.)

How are you implementing refusing-names-beginning-with-underscore, out
of curiosity?

> You could also take a look at Jinja (which is also a template-engine),
> and which claims to include a sandbox. But the Jinja-sandbox seems to
> be much more complicated than my pseudo-sandbox, and I haven't analyzed
> it and don't know how it works.

I'll take a look.

>> I just need a certain limited context where someone can be handed
>> certain Python objects and manipulate them. I'd like people to be able
>> to use some fundamental Python power -- the rich, beautiful data types
>> for example (notably in this case, strings), list comprehensions and
>> stuff, to do what they need to do. Python's very easy, I'd like them to
>> be able to use that easy.
> I was in the exact same position ;).
> (Although I don't have fully untrusted/bad users, and so my pseudo-sandbox
> is sufficient for my cases, even though I haven't proved that it really is
> secure...)

I don't *really* have a bunch fully untrusted / bad users, in fact I
expect I will sort of trust all the people doing this level of coding --
but I believe that either incompetance and maliciousness is inevitable
in any sort of online community, and making it at least as hard as
possible to do damage while giving people as much freedom and tools to
do great is the ideal goal. :)

-- 

   Stephen Hansen
   ... Also: Ixokai
   ... Mail: me+list/python (AT) ixokai (DOT) io
   ... Blog: http://meh.ixokai.io/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 487 bytes
Desc: OpenPGP digital signature
URL: <http://mail.python.org/pipermail/python-list/attachments/20100814/0d2d9665/attachment-0001.sig>