I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that introduce security holes or other vulnerabilities into the system. Are there any best-practices available, recommended reading, or other pointers you can give me make my service usable but not abusable?
Here's what I've considered so far:
execcontext to prohibit use of potentially dangerous packages like
os. Users will only be able to use packages I provide to them.
- Use threads to enforce a reasonable timeout.
- I'd like to limit the total amount of memory that can be allocated within the
execcontext, but I'm not sure if it's even possible.
There are some alternatives to a straight
exec, but I'm not sure which of these would be helpful here:
- Using an
ast.NodeVisitorto catch any attempt to access unsafe objects. But what objects should I prohibit?
- Searching for any double-underscores in the input. (less graceful than the above option).
PyPyor something similar to sandbox the code.