If you want to be extra careful of user input you may want to look at
Docker. http://www.docker.com/
This should give you the highest level of security against user input.
We are using it to run users untrusted code.
- icydee
On 10 June 2014 08:20, Abigail <abig...@abigail.be> wrote:
> On Tue, Jun 10, 2014 at 07:10:30AM +0100, Andrew Beverley wrote:
> > On Mon, 2014-06-09 at 11:36 +0100, Andrew Beverley wrote:
> > > Dear all,
> > >
> > > I'd like to take a condition specified by a user and use it to perform
> a
> > > set of tests on a data set. Is there a module to do this?
> >
> > Thanks for all the replies.
> >
> > Indeed, I can't trust the user input, but nonetheless I wondered whether
> > I could still use eval, but heavily sanitise the input. It seems a lot
> > easier than than using a parser.
>
> Doubtful.
>
> > Can anyone see anything wrong with the following? The user-supplied
> > variables are specified in square brackets, e.g. "[age]"
> >
> > # Sub in the variable values
> > foreach my $var (@variables)
> > {
> > my $value = ... # Could be a string in quotes
> > $code =~ s/\[$var\]/$value/gi;
> > }
> >
> > # Sanitise
> > $_ = $code;
> > return unless /^[ \S]+$/; # Only allow normal spaces
> > return if /[\[\]]+/; # No brackets should remain
> > return if /\\/; # No escapes please
> > s/"[^"]+"//g; # Remove quoted strings
> > m!^([-()*+/0-9<> ]|&&|eq)+$! or return; # Allowed expression chars
>
>
> So, you excluding having any alpha char (except 'eq') in the resulting
> expression? Because that's what the last line does. Perhaps that's your
> intention, because I've no idea what $value is going to be, other than
> "it could be a string in quotes".
>
> Now, if you do allow for alpha characters to be present, you have to make
> sure things like "system qw xrm -rf foox" are filtered out. (As you can
> see,
> the "remove quoted strings" isn't much of a filter -- q, qq, qw, qx, qr,
> s, m,
> and y can take any delimiter).
>
>
>
> Abigail
>
