3 ms·

Nice project, but you NEED some sandboxing. import os print os.listdir('.') print open('turtle.py').read() Edit: It seems like you're doing some; i can'

• shenberg 15y ago
  Python had an implementation of sandboxing (rexec), but gave up plugging the holes people kept finding in it (see http://docs.python.org/library/rexec.html http://docs.python.org/library/rexec.html). The problem is that sandboxing wasn't designed into the language so they don't give users a false sense of security with a bad sandbox. To see the legacy of the sandbox, open an interpreter and run 'del __builtins__' to activate the restricted execution mode. Now, a lot of simple things like the import statement should fail. A good exercise in python internals is to manage to execute unrestricted code from this state via clever use of introspection. Note: 'del __builtins__' is more than just removing access to builtin objects: >>> f = file >>> del __builtins__ >>> f('a.txt','w') Traceback (most recent call last): File "<stdin>", line 1, in <module> IOError: file() constructor not accessible in restricted mode