3 ms·
Until someone sends serialized code-data like: for i = 1, 1000000 do for j = 1, 1000000 do for k = 1, 1000000 do for l
by kstenerud 6y ago
Until someone sends serialized code-data like:
for i = 1, 1000000 do
for j = 1, 1000000 do
for k = 1, 1000000 do
for l = 1, 1000000 do
...
Once you move your publicly injectable data format from declarative to something else, you're in for a world of hurt.
- nmadden 6y agoTcl has had sandboxed interpreters with resource limits for a long time [1]. You can even remove built-in commands (for/while etc) if you want to. You can limit the language to a purely declarative subset and selectively expose commands and resources as you wish. [1]: https://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm#M46 https://www.tcl.tk/man/tcl8.5/TclCmd/interp.htm#M46
- dividuum 6y agoIf you use Lua only for your configuration data, patching the Lua interpreter to limit the CPU time is rather easy: Increment a counter within your lua_State struct here: https://github.com/lua/lua/blob/c33b1728aeb7dfeec4013562660e07d32697aa6b/lvm.c#L1150 https://github.com/lua/lua/blob/c33b1728aeb7dfeec4013562660e..., then abort once you reach a limit.