4 ms·
Didn't we decide a long while back that fully featured programming languages were dangerous in the browser, especially if they could do disk I/O? Even if sandbo
by Alupis 8y ago
Didn't we decide a long while back that fully featured programming languages were dangerous in the browser, especially if they could do disk I/O? Even if sandboxed? A la Java Applets and Adobe Flash?
import os
for subdir, dirs, files in os.walk('./'):
for file in files:
print file
os.remove(file)
Perhaps the environment is "fake", and these files don't really exist, even in some sandbox... otherwise, seems like this might pose a security risk.
- Klathmon 8y agoI don't know about PyPy.js specifically, but most systems like this provide a virtual filesystem that maps back to things like indexedDB and localstorage which are browser APIs. There is no way that pypy.js is able to access local files on your machine outside of the browser sandbox.
- chillydawg 8y agoI bet there's a few cheeky hackers around the world who may disagree with that statement. Always assume it's broken.
- russx2 8y agoNo, not in this case. It's running in JS land in the browser so any exploits to break out of the browser sandbox using this could be done simpler with raw JS.
- star-techate 8y ago1. I'll copy&paste this to test it! 2. uh ok I'll paste it into an editor and remove the added indentation and then copy&paste that to test it 3. ... ok. I'll look at the code and reformat every single line and copy&paste that the oldest complaint abides
- lucb1e 8y agoThis is Javascript, not real Python. If you're so afraid that this is dangerous, why do you post malicious code? And if you're so clever to post that code, why don't you try similar code to see if it really has access to your files? import os os.listdir('/') The answer, by the way, is no.
- Alupis 8y ago> If you're so afraid that this is dangerous, why do you post malicious code? That's not malicious code... it removes files from a sandbox... you can refresh the page and see for yourself. > And if you're so clever to post that code There's no need to be rude... there's an honest question and lack of understanding in my post - educate me, don't talk down to me. > why don't you try similar code to see if it really has access to your files The question was if someone could break out of a sandbox, such as with Java Applets and Adobe Flash. I have no idea how to do that - I'm not a security specialist, nor some sort of hacker guy. > The answer, by the way, is no. From the sandbox and using the standard `import os`, ya, you're right. The question, again, is what if someone got outside the sandbox?
- Macha 8y agoWell why doesn't this apply to JS? The python interpreter is running in the JS sandbox
- Alupis 8y agoI suppose that was the explanation I was looking for.
- lucb1e 8y agoThanks for the elaborate response, now I much better understand what you're trying to say. This is different from the examples you mention: there is no external software that creates the sandbox (whereas with Java and Flash you had to install those as plugins). It's really just Javascript as it is built into the browser. Any vulnerability in this "sandbox" is a vulnerability in the browser, not some 3rd party plugin. Put differently, this pypy emulation is no different from the Javascript API that was in your browser already. This isn't a new plugin, just using Javascript to emulate Python through the Pypy interpreter.