4 ms·
You can always sandbox the process if you don't trust the input. Ruby has taint checking built-in and most operating systems have lightweight sandboxing solutio
by memexy 6y ago
You can always sandbox the process if you don't trust the input. Ruby has taint checking built-in and most operating systems have lightweight sandboxing solutions. Docker is another way to go. You can just execute the script in a container and then grab standard output as the configuration.
- artifact_44 6y agobarf barf barf aaaaand barf.
- plorkyeran 6y agoA much simpler thing to do is to simply disable all of the standard library functions which allow i/o. Lua has functionality specifically intended for limiting the environment available to a script, and the standard library is small enough that doing this is actually practical.
- memexy 6y agoI remember playing around with Lua but didn't look too closely at sandboxing facilities but what you say makes sense.
- Dylan16807 6y ago> You can just execute the script in a container and then grab standard output as the configuration. In what format, that you then have to parse?
- memexy 6y agoYes. If you're passing it to another process then you would need to parse it. If you were using it in the same process and not crossing sandbox boundaries then you could just pass around whatever data structure was generated without serializing it into another format.