Closed johnjosephhorton closed 1 month ago
@johnjosephhorton A solution that I've seen in CTF challenges is RestrictedPython. It blocks all the dangerous methods that could lead to a server compromise.
Observation: By default RestrictedPython blocks for loops too because it can create infinite code logic that consumes the CPU. If we want to allow the user to use for loops then we can implement a protection by setting a limit execution time for the method.
Interesting - is the loop execution restriction part of RestrictedPython or would we have to add that ourselves?
We have to run the code in a thread with execution time limit. This is the solution that we have to add. RestrictedPyhon doesn't provide this by default and just suggests that you have to choose your own strategy when allowing for loops.
QuestionFunctional
takes afunc
parameter that is a python function. Obviously, we cannot just eval this back to life from serialized form. But perhaps with enough safety checks, we could serialize a function if we were sure it was purely functional w/ no side effects.@zer0dss this is more your lane - any ideas? Is there some safe way for us to do this?
E.g., here's a ChatGPT idea