search

Corveda / PHPSandbox

A PHP-based sandboxing library with a full suite of configuration and validation options.
https://phpsandbox.org
Other
220 stars 46 forks source link

Can you run sql/mysql queries within the sandbox? #40

Closed titonova closed 5 months ago

titonova commented 5 months ago

What happens if you attempt to do so? What if you want to enable such functionality. what do you do?

fieryprophet commented 5 months ago

What happens if you attempt to do so? What if you want to enable such functionality. what do you do?

If the relevant class or functions are enabled by the sandbox then they will work perfectly fine. This library is a userland implementation of a sandbox, e.g. it basically looks at the PHP source it is passed and checks that it passes the configuration it was defined with, with some source-rewriting to defeat attempts by ingested code to break out of it.

This is about the extent that is achievable in a userland context because stronger security would have to be implemented via an extension and within the PHP environment itself, the OS, etc. but also means that pretty much anything will work with it if given permission to do so via configuration. But once you have given the sandbox access to DBs it does not do any form of SQL-injection proofing or mitigation of whatever that code tries to do with the functionality.