apitools / sandbox.lua Goto Github PK
View Code? Open in Web Editor NEWA lua sandbox for executing non-trusted code
License: MIT License
A lua sandbox for executing non-trusted code
License: MIT License
How to detect and disallow slow pattern matching?
("a"):rep(100):match(patt)
where patt
might be:
'a+a+b'
: too low to measure'a+a+a+b'
: 0.08 seconds'a+a+a+a+b'
: 1.3 seconds'a+a+a+a+a+b'
: 20.3 secondsMy use case right now involves using the sandbox not to stop infinite loops, but to make sure an outside condition can stop whatever's running in the sandbox (I'm using the Love2D engine, which allows me to run threads, so my stop condition is based on another thread running concurrently).
I will implement this myself within my project, but I will also send a pull request if I feel it is worth sharing, and if anyone else finds it useful.
By using quota = false
, the hooks should not be in place.
Hey, can sandbox.lua also protect the LuaJit engine? Would be nice to have a compatible sandbox.
I don't care so much about CPU limits, more like "real" security issues like deleting files.
Many regards,
kung foo man
Due to what appears to be an interpreter bug, you can cause infinite loops in LuaJIT. The loops are not allowed in Lua 5.1 and 5.2. Due to the sensitive nature of this bug, and the fact that I don't know how widely this is used, I won't specify how to cause the loops. E-Mail me or contact me on freenode IRC (nick=ShadowNinja) for details, unless you think that nobody much uses this with LuaJIT. :-) As far as I know there's no way to fix this other than to sanitize the input or switch to non-JIT Lua.
That's sure to be an interesting journey
Hello,
I wonder why os.date
is not present in the sandbox ?
Is this function is dangerous ? or is it a mistake ?
Best Regards,
Also, make immune absence of debug.sehook
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.