Comments (4)
Sorry for the late reply, I have no excuse for not answering earlier.
PHP sandboxing was one of my first motivations behind this project, but it is a rather complicated problem if you want to do it by static code analysis / preprocessing. If you are going to evaluate user-submitted code then the only really safe way is to evaluate it in a separate jail (or whever the operating system provides).
Sandboxing through preprocessing is really hard in PHP, because of its dynamic nature. You can easily check that exec(...)
is disallowed, but it already is harder to make sure $func()
is safe. But that's just the beginning. There are many, many subtle ways in PHP to run something, which are often little-known or easy to overlook. E.g. you could easily miss some particular function taking a callback or some indirect way of executing a call, like with (new ReflectionFunction('exec'))->invoke(...)
.
So I'm not really sure whether this kind of security checking makes any practical sense as there are just too many points of failure. I find this mostly intriguing from the theoretical point of view. So after I saw this issue I took some old tokenizer-based sandbox code and ported it to use the PHP-Parser. While doing that I found a lot of issues, which I'm trying to resolve. If I manage to figure everything out I'll publish the library. Though as I said, I don't think that it makes sense to use this in practice.
So, to answer the question: Yes, it's possible. But whether it makes sense depends on the specific case. (The narrower the case the easier it should be to properly handle it.)
Again, sorry for the late reply.
from php-parser.
Hey nikic, I wrote a sandbox and have it live here http://phpbounce.aws.af.cm
I got through linting, parsing, whitelisting, blacklisting and separate process sandbox. I've switched off whitelisting, but I'm not sure how secure it is. Can you check it out?
BTW, this is a very impressive project for someone who is 17!
from php-parser.
From a quick look at the code you seem to be using PHP's internal disable_functions
and disable_classes
features. There should be no way around those short of exploiting PHP itself. Though I obviously don't know how complete the blacklists you are using are.
from php-parser.
Indeed, in fact in my whitelist, I went through 4400 functions manually. Anyway thanks for the code it works well.
from php-parser.
Related Issues (20)
- `elseif` vs `else if` node structure HOT 3
- Readonly not Inherited From Class Onto Property HOT 1
- Disappearing comments HOT 4
- BuilderHelpers::normalizeValue could normalize enum values
- How do you obtain the file name of a node? HOT 1
- [Question] How to add a class constant inside an array ? HOT 2
- Global symbols usage HOT 3
- v4.7.1 When parsing the array, the numeric key name was lost HOT 1
- php composer.phar problem HOT 1
- Removal of Stmt\Throw not mentioned in UPGRADING
- Comment attributes not being repeated for nested nodes is not in UPGRADING guide
- [5.0] Parser crashes on an empty file HOT 1
- [Format-preserving printer] How to get rid of trailing commas in function calls/parameter definitions/closure uses HOT 2
- [5.0] PropertyItem extends Stmt by mistake? HOT 1
- 5.0.0 - Call to undefined method PhpParser\ParserFactory::createForHostVersion() HOT 2
- Declaration of PhpParser\Parser\Multiple::parse HOT 1
- Upgrade Guide to v5.0 -- typo error on Changes to the lexer chapter
- TokenPolyfill tries to construct itself with an id which is a string HOT 5
- getPhpVersion() method has different return type in V5 HOT 2
- Should PhpParser\Node\Name extend PhpParser\Node\Expr ? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from php-parser.