embedding a safe unescapable mini perl interpreter?

iaw4 has asked for the wisdom of the Perl Monks concerning the following question:

I would like to allow my web users to execute little perl calculator programs: they could enter into my webform textarea field something like:

sub cubed { return $_[0]**3; }
$a=3 ;
25+$a**2 + cubed($a)
[download]

when the user hits submit, my server-side cgi script executes this snippet to learn that the user wanted '61'. later, the server will (eventually) return an html page that says "the result of your program {spit back what the user entered above} is 61." I want to predefine a few functions for the user myself, too, such as squared, cubed, etc., but still allow my own users to define their functions, too.

obviously, I do not want my users to inject nasty code, either into the html [I spit back what they entered); or worse, locally escape into my system (via system, backquote, or other nastily crafted entries.

so, I need a safe, sanitized subset version of perl that I can execute. I am probably not the first one in need of this, but I was hoping that someone could point me to where this has been put together already.

I could live with a non-perl syntax for my users, too, as long as it allows them to define their own functions and is reasonably safe. since my cgi server script is in perl, perl-like syntax may be advantageous.

pointers appreciated.

Comment on embedding a safe unescapable mini perl interpreter? Download Code

Replies are listed 'Best First'.
Re: embedding a safe unescapable mini perl interpreter? by sflitman (Hermit) on Dec 30, 2011 at 07:45 UTC
Check out the Safe module, it does exactly what you want. HTH, SSF	[reply]
Re: embedding a safe unescapable mini perl interpreter? by Anonymous Monk on Dec 30, 2011 at 07:41 UTC
Embedded scripting sandbox? Lua?, Preferred Scripting Language to Embed?, New Book: Exploring Programming Language Architecture in Perl	[reply]
Re: embedding a safe unescapable mini perl interpreter? by roboticus (Chancellor) on Dec 30, 2011 at 17:15 UTC
law4: Because of the arguments suggested previously (security, DOS, etc.), you might want to consider putting your functionality in Javascript and let the code run in the browser. That way you can avoid many(?/most/all?) of the problems with letting the user specify code you'll execute on your server. Just sayin'... ...roboticus When your only tool is a hammer, all problems look like your thumb.	[reply]
Re^2: embedding a safe unescapable mini perl interpreter? by iaw4 (Monk) on Dec 31, 2011 at 05:49 UTC
thanks, everyone. A sandbox alone is not trustworthy enough. the problem is intrinsically pretty bad. public internet. And I want one user to make up a question for another anonymous user to answer. (this also means that 'javascript as sandbox' won't work.) User 1 inputs something like `$x=round(rand(),1); print "If x is $x, then what is x^2?";` [download] User 2 may see `if x is 0.5, then what is x^2?` [download] The '0.5' is obviously computed, based on what user 1 provided. I need to avoid user 1 inputting mischief. Finally, user 1 receives back what the answer was that user 2 gave and can check whether it was correct. because answers are not algorithms (the way questions are), I can easily sanitize what user 2 provides. Do I really have to write my own language and parser for this? no one else has? regards, /iaw	[reply] [d/l] [select]
Re^3: embedding a safe unescapable mini perl interpreter? by ww (Archbishop) on Dec 31, 2011 at 12:39 UTC
The little requirement that your project has to be multi-user may have merited mention in your OP. And as to your associated new question -- writing your own language -- I don't see how an eviscerated Perl can still provide even the functionality you've described. So maybe a new language has potential; maybe you simply need to code up a better sandbox; or maybe you should reconsider the design, aiming for a Q&A thread relying on users' machines for the computations.	[reply]
Re^3: embedding a safe unescapable mini perl interpreter? by RichardK (Parson) on Dec 31, 2011 at 13:56 UTC
Well theoretically any Turing complete language is going to be a problem, as it cannot be proved to be secure. There's a really interesting presentation about these issues here http://boingboing.net/2011/12/28/linguistics-turing-completene.html It's a keynote speech at the 28th Chaos Computer Congress (28C3) by Meredith Patterson on "The Science of Insecurity". I highly recommend it, it's definitely worth watching. So I think you have to write your own language, and only including the functionally that is needed, and keeping it as simple as possible. Parse::RecDescent is a good place to start, it makes working with grammars quite easy :) The key issue is the complexity of the allowed expressions, if you can keep to a context-free grammar the you might get away with it. But my guess is that you will need to have a human in the loop to check and approve each submission before they go live.	[reply]
Re^4: embedding a safe unescapable mini perl interpreter? by iaw4 (Monk) on Jan 01, 2012 at 05:49 UTC
Re^5: embedding a safe unescapable mini perl interpreter? by Anonymous Monk on Jan 01, 2012 at 06:06 UTC
Re: embedding a safe unescapable mini perl interpreter? by Anonymous Monk on Dec 30, 2011 at 08:31 UTC
And for your "spit back their input in HTML" problem, search for HTML escaping functions. It can be as simple as: `sub escape { $_ = shift; s/&/&/g; s/</</g; s/>/>/g; s/"/"/g; return $_; }`	[reply] [d/l]
Re: embedding a safe unescapable mini perl interpreter? by TJPride (Pilgrim) on Dec 30, 2011 at 16:14 UTC
You do realize that even if you "safe" this, someone can easily DOS you using the right formulas? It would take me only a few minutes to write a script to do that. Allowing users ANY sort of free-form scripting is a bad idea.	[reply]
Re^2: embedding a safe unescapable mini perl interpreter? by cavac (Prior) on Dec 30, 2011 at 18:27 UTC
You do realize that even if you "safe" this, someone can easily DOS you using the right formulas? In my opinion, the scope of the problem depends on your environment. Using such a thing on the public internet would be a bad idea. If you have such a tool in your companies intranet (preferably only accessible via some form of authentification), the DOS problem is probably non-existent or at most a one-off thing (e.g. something that can be taken care of permanently by calling the human resources department). BREW /very/strong/coffee HTTP/1.1 Host: goodmorning.example.com 418 I'm a teapot	[reply]
Re^2: embedding a safe unescapable mini perl interpreter? by Anonymous Monk on Dec 31, 2011 at 07:36 UTC
This is what throttling is for, and virtual machiines	[reply]