[Ironruby-core] Running IR in an isolated AppDomain

[Pascal Normandin]

Hello,

 

I'm trying to add scripting capability to a wiki type web application with
IronRuby.  I want to run IR in a low trust environment with only access to
variables provided in the scope.  Those variables are helper objects that
have access to local resources i.e. FS.

 

I'm able to create the AppDomain with restricted security, run IR in that
AppDomain and use the helper objet from IR but I have a problem when
invoking a method of the helper object that has access to the file system.

 

When I call my helper.GetFileContent() method (see below) from the IR
AppDomain I receive the following exception

 

Request for the permission of type
'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089' failed

 

At some point I thought that maybe the code is being executed from the IR
AppDomain so I added a check on the AppDomain Name and it is executing in
the Main AppDomain not the IR AppDomain.

 

Does anyone have an idea why it is behaving like that?

Is this the expected behaviour?

Or do you have any tip to help me troubleshoot and find the root of this?

 

Thank you;

Pascal Normandin

 

 

Here is my Helper class

 

    public class Helper : MarshalByRefObject {

        public string GetFileContent() {

            var appDomainName = AppDomain.CurrentDomain.FriendlyName;

            StreamReader rdr = File.OpenText("C:\\test\\test.txt");

            return rdr.ReadToEnd();

        }

    }

 

 

Here is How I create the ScriptRuntime in the AppDomain

 

        protected static ScriptRuntime CreateIronRubyRuntime()

        {

            // Setup the ruby engine in a Sandbox

            var rubySetup = Ruby.CreateRubySetup();

 

            rubySetup.Options["InterpretedMode"] = true;

 

            var runtimeSetup = new ScriptRuntimeSetup();

            runtimeSetup.LanguageSetups.Add(rubySetup);

            runtimeSetup.DebugMode = false;

 

            AppDomainSetup info = new AppDomainSetup();

            info.ApplicationBase = AppDomain.CurrentDomain.BaseDirectory +
"\\bin";

            info.ApplicationName = "Wiki";

 

            PermissionSet ps1 = new PermissionSet(PermissionState.None);

            SecurityPermissionFlag flag =
SecurityPermissionFlag.SkipVerification | SecurityPermissionFlag.Execution |
SecurityPermissionFlag.ControlAppDomain;

            ps1.AddPermission(new SecurityPermission(flag));

 

            AppDomain newDomain = AppDomain.CreateDomain("IR", null, info,
ps1);

 

            ScriptRuntime runtime = ScriptRuntime.CreateRemote(newDomain,
runtimeSetup);

 

            return runtime;

        }

 

 

Here is how I execute the IR script

 

                var rubyEngine = Ruby.GetEngine(runtime);

                ScriptScope scope = runtime.CreateScope();

 

                StringBuilder sb = new StringBuilder();

                scope.SetVariable("output", sb);

                Helper helper = new Helper();

                scope.SetVariable("helper", helper);

 

                ScriptSource source =
rubyEngine.CreateScriptSourceFromString("output.append(helper.GetFileContent
())");

                source.Execute(scope);

 


_______________________________________________
Ironruby-core mailing list
Ironruby-core@rubyforge.org
http://rubyforge.org/mailman/listinfo/ironruby-core