On Wed, 11 Feb 2004, Randal L. Schwartz wrote: > Earl> Just wondering about the security implications, if there other things I > Earl> should do, and if there are sites out there that process pages provided by > Earl> untrusted users.
I'm working on a related tool (a wiki site), and I think that there should be a collective effort in enucleating the security weakness of the TT system (thanks Randal). The simplest thing would be to to automatically choose a "safe" environment, with respect to files, cpu, memory, etc. I've tried using the Safe module, but Randal's example still escapes. Should one set up a chrooted subprocess and send it the code to be evaluated? -- Franco Bagnoli (franchino) <[EMAIL PROTECTED]> ([EMAIL PROTECTED]) virtual location: Dipartimento di Energetica "S. Stecco" ultra-virtual affiliation: Centro Dinamiche Complesse (CSDC-Firenze) real location: Dip. Matematica Applicata "G. Sansone", Universita' Firenze, Via S. Marta, 3 I-50139 Firenze, Italy. Tel. +39 0554796422, fax: +39 055471787 _______________________________________________ templates mailing list [EMAIL PROTECTED] http://lists.template-toolkit.org/mailman/listinfo/templates
