Re^2: Avoiding Greenspun's Rule; scripting within Perl

I've not used JavaScript::V8, but have used JavaScript::SpiderMonkey and JE (the latter of which is a pure Perl javascript implementation!) and find Javascript to be a good choice for this sort of thing.

I have also taken a look at the various Perl Lua offerings (Inline::Lua, Outline::Lua, etc), but none of them have impressed me much. I can't seem to find a way to, for example, lock down Lua's file IO functions, so it doesn't seem to be useful as a sandbox. (It might be possible with Lua::API, but that module is very low level and I've not had much success with it.)

perl -E'sub Monkey::do{say$_,for@_,do{($monkey=[caller(0)]->[3])=~s{::}{ }and$monkey}}"Monkey say"->Monkey::do'

Comment on Re^2: Avoiding Greenspun's Rule; scripting within Perl

Replies are listed 'Best First'.
Re^3: Avoiding Greenspun's Rule; scripting within Perl by Anonymous Monk on Mar 22, 2012 at 16:41 UTC
I can't seem to find a way to, for example, lock down Lua's file IO functions, That is easy, compile lua.dll without the file/io extension :) Or undefine io `io = nil;` but you have to disable `require('io');` with `require = nil` ... It doesn't matter much which API you use, you setup your lua sandbox, then call runcode $userinput -- read/combine these :) http://lua-users.org/wiki/LuaSecurity http://lua-users.org/wiki/SandBoxes http://www.corsix.org/lua/bytecode_abuse_0_1.lua http://stackoverflow.com/questions/5097993/lua-sandboxing-eliminating-function-creation http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/966162/best-way-to-omit-lua-standard-libraries http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/#demo Re^3: Embedded scripting sandbox? Lua? http://luadist.org/	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^3: Avoiding Greenspun's Rule; scripting within Perl
by Anonymous Monk on Mar 22, 2012 at 16:41 UTC

I can't seem to find a way to, for example, lock down Lua's file IO functions,

That is easy, compile lua.dll without the file/io extension :)

Or undefine io io = nil; but you have to disable require('io'); with require = nil ...

It doesn't matter much which API you use, you setup your lua sandbox, then call runcode $userinput -- read/combine these :)

[reply]
[d/l]
[select]