How to run untrusted Ruby code inside a safe sandbox?

by

$SAFE is not enough; you need to be at least at the level of Why’s freaky sandbox. However, I don’t know if that sandbox code is actively maintained or if he/they ever solved the holes such as infinite loops, etc.

Unsafe generally means hostile. If you can relax from hostile to, say, ‘naive’, and depending upon the requirements of your app, you might get away with sandboxing in Ruby. It’s not really a first-class scenario in the language design.

Even with that, though, you probably don’t need to go to the machine level of separation. I’d feel pretty safe using a sandbox in a separately spawned process, with your app functioning as a process manager to kill off any that manage to hang/flame. Now, that is a few orders of magnitude more work than your simple block above.

But remember and keep repeating, “SAFE can’t deal with hostile”.

More Related Contents:

  1. Reassigning the value of variables in Ruby?
  2. What is attr_accessor in Ruby?
  3. Ruby: String Comparison Issues
  4. Ruby 2.0.0p0 IRB warning: “DL is deprecated, please use Fiddle”
  5. How to get the name of the calling method?
  6. Why is `a = a` `nil` in Ruby?
  7. What exactly is `&:capitalize` in Ruby?
  8. Ruby’s File.open and the need for f.close
  9. Difference between map and collect in Ruby?
  10. How does “(1..4).inject(&:+)” work in Ruby
  11. Is sort in Ruby stable?
  12. How to check whether a string contains a substring in Ruby
  13. How to get a specific output iterating a hash in Ruby?
  14. Does Ruby perform Tail Call Optimization?
  15. How do I use define_method to create class methods?
  16. How do I stub things in MiniTest?
  17. When to use each method of launching a subprocess in Ruby
  18. Ruby run shell command in a specific directory
  19. Check if URL exists in Ruby
  20. Using Ruby Symbols
  21. Ruby: Can I write multi-line string with no concatenation?
  22. What does the equal (‘=’) symbol do when put after the method name in a method definition?
  23. Why does “compass watch” say it cannot load sass/script/node (LoadError)?
  24. When to use `require`, `load` or `autoload` in Ruby?
  25. How to install command line tools on OSX Mavericks
  26. How can I get the absolute URL when extracting links using Nokogiri?
  27. In Ruby why won’t `foo = true unless defined?(foo)` make the assignment?
  28. How to determine if a character is a Chinese character
  29. What does the unary question mark (?) operator do?
  30. Should I use alias or alias_method?

Leave a Comment