Re: Avoiding Greenspun's Rule; scripting within Perl

Many projects I've been writing lately have included the ability to use Javascript via JavaScript::V8. It is cheap and it is blazingly fast and if you are a web shop then you most likely have a team that already speaks Javascript.

I'd like to use perl as an embeded language inside of perl, but I have yet to see a safe (Safe.pm) locked down environment. Javascript isn't perfect as they could still consume all memory, or write an infinite loop, but there is no danger of it having access to more than I give it.

my @a=qw(random brilliant braindead); print $a[rand(@a)];

Comment on Re: Avoiding Greenspun's Rule; scripting within Perl

Replies are listed 'Best First'.
Re^2: Avoiding Greenspun's Rule; scripting within Perl by tobyink (Canon) on Mar 22, 2012 at 14:20 UTC
I've not used JavaScript::V8, but have used JavaScript::SpiderMonkey and JE (the latter of which is a pure Perl javascript implementation!) and find Javascript to be a good choice for this sort of thing. I have also taken a look at the various Perl Lua offerings (Inline::Lua, Outline::Lua, etc), but none of them have impressed me much. I can't seem to find a way to, for example, lock down Lua's file IO functions, so it doesn't seem to be useful as a sandbox. (It might be possible with Lua::API, but that module is very low level and I've not had much success with it.) `perl -E'sub Monkey::do{say$_,for@_,do{($monkey=[caller(0)]->[3])=~s{::}{ }and$monkey}}"Monkey say"->Monkey::do'`	[reply]
Re^3: Avoiding Greenspun's Rule; scripting within Perl by Anonymous Monk on Mar 22, 2012 at 16:41 UTC
I can't seem to find a way to, for example, lock down Lua's file IO functions, That is easy, compile lua.dll without the file/io extension :) Or undefine io `io = nil;` but you have to disable `require('io');` with `require = nil` ... It doesn't matter much which API you use, you setup your lua sandbox, then call runcode $userinput -- read/combine these :) http://lua-users.org/wiki/LuaSecurity http://lua-users.org/wiki/SandBoxes http://www.corsix.org/lua/bytecode_abuse_0_1.lua http://stackoverflow.com/questions/5097993/lua-sandboxing-eliminating-function-creation http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox http://stackoverflow.com/questions/966162/best-way-to-omit-lua-standard-libraries http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/#demo Re^3: Embedded scripting sandbox? Lua? http://luadist.org/	[reply] [d/l] [select]