search

Corveda / PHPSandbox

A PHP-based sandboxing library with a full suite of configuration and validation options.
https://phpsandbox.org
Other
220 stars 46 forks source link

Safe to run user's input code #14

Closed yellow1912 closed 5 years ago

yellow1912 commented 6 years ago

I plan to use this library to run user's input code in isolated environment with most functions blacklisted by default. (On some relatively safe string and array manipulation). I wonder if there is any security that I should consider? I can imagine that all the SERVER, SESSION variables should be blacklisted or overriden as well?

fieryprophet commented 5 years ago

The sandbox by default operates within a whitelist format, e.g. it will disallow almost everything unless you explicitly allow for it. I would utilize the whitelisting feature to only enable the functionality you need rather than trying to find a perfect blacklist configuration. By default, access to all superglobals is already disabled.