search

Irev-Dev / cadhub

We're out to raise awareness and put CodeCAD on the map. The success of CadHub can be measured by the amount it promotes the use of CodeCAD within the mechanical/manufacturing industry and the strength the CadHub community.
https://cadhub.xyz
GNU General Public License v3.0
319 stars 60 forks source link

python execute security #611

Open Irev-Dev opened 2 years ago

Irev-Dev commented 2 years ago

Python execute has been disabled for the time being.

Since python is a general purpose language getting security right is trick, the way it currently runs it would be possible to grab some aws credentials, as well as other things like crypto mining, the 30s execute limit does help but does not fix the problem.

Much more robust tracing and limits are needed before enabling this feature again.

jdegenstein commented 2 years ago

Just doing some quick research on how to secure python execution and thought I would leave this here for consideration:

https://github.com/zopefoundation/RestrictedPython

Irev-Dev commented 2 years ago

Thanks @jdegenstein

42sol-eu commented 1 year ago

Anything new on that?

notthewave commented 9 months ago

What about using web assembly? I am certainly not an expert when it comes to web development but it might work for this use case: https://webassembly.org/docs/security/ https://github.com/pyodide/pyodide