aahnik
commented
3 years ago I am doing research, as to how to build my own API for running python code.
Running python code and returning the result is easy. A simple solution is to use a python subprocess to run python -c {code}, and then get the stdout and stderr.
v0.0.5 of this project and earlier, used to run the code submitted by users directly in the server the bot is running.
But python is powerful and using python code, anyone can hack the server. Me banning certain python keywords and imports made the bot less useful. But still hackable. Using escape sequences, and other tons of tricks, one could hack the server.
Then from v0.1.0 onwards, I used the rextester API, which ran a piece of python code and returned the result. So, I had no more worry, as the python code ran on their server, it's their headache now.
But rextester API become paid from April 10, 2021.
So, now I am planning to build my own API that executes python code.
Challenges:
- we will be accepting code from an untrusted source.
- accidental bugs, or malicious design can hack the server, or consume too much CPU/memory/disk space.
- people could use the service to do malicious things
So currently I am researching how to implement a solution
Here are the links to stuff that I am exploring
Rextester now requires API TOKEN to use its API.
Bot no longer doing the main thing it is supposed to do.