Im developing a game where the players will program their equipment with
python. Are there any ways to run insecure code? I dont want the clients
to mess with the server-code through their own code, or even DOS the box
by using up too much memory.
Here is some examples of how the equipment should be programmed:
---
# Proxmity explosive example
import cpu
explosive = cpu.connection( 0x01,"explosive ")
motion_detector = cpu.connection( 0x02,"explosive ")
class Main:
def event_Motion(se lf):
explosive.trigg er(delay=0)
cpu.reg_event(m otion_detector. event_Motion, self.event_Moti on)
cpu.start()
---
# Broadcast chat equipment
import cpu
import io
terminal = cpu.connection( 0x01,"User personal terminal connection")
radio = cpu.connection( 0x02,"Radio tranceiver")
mem = cpu.connection( 0x03,"Memory chip")
if mem.get("FREQ") == None: freq = 12345 ; mem.store("FREQ ",12345)
class Main:
cpu.reg_event(r adio.receive, self.event_Mess age)
cpu.reg_event(t erminal.input, self.event_Inpu t)
def event_Message(s elf,message):
terminal.write( message + "\r\n")
def event_Input(sel f,data):
if data[0] == "/":
if string.upper(st ring.split(data[1:]))[0] == "CHANNEL":
radio.setFreq(i nt(string.split (data)[2]))
mem.store("FREQ ",int(string.sp lit(data)[2])
else:
radio.send(data )
---
I see the following problems:
1. looping code
Are there any way to avoid this by checking the "eip" within a usercode?
Is it possible to multiplex between user codes to avoid this?
Is it possible to limit execution speed (set the cpu to 5 instructions
pr second)
2. blocking code / untrusted/insecure code
Is there a effective way to limit the available functions the usercode?
(perhaps like the java securityhandler way)
3. memory-dos
Limiting the storage size (or even forcing the user to store EVERYTHING
in the mem object)
I dont know if this is even possible (without modifying the python
source, which would force me to perhaps seperate server code and user code)
python. Are there any ways to run insecure code? I dont want the clients
to mess with the server-code through their own code, or even DOS the box
by using up too much memory.
Here is some examples of how the equipment should be programmed:
---
# Proxmity explosive example
import cpu
explosive = cpu.connection( 0x01,"explosive ")
motion_detector = cpu.connection( 0x02,"explosive ")
class Main:
def event_Motion(se lf):
explosive.trigg er(delay=0)
cpu.reg_event(m otion_detector. event_Motion, self.event_Moti on)
cpu.start()
---
# Broadcast chat equipment
import cpu
import io
terminal = cpu.connection( 0x01,"User personal terminal connection")
radio = cpu.connection( 0x02,"Radio tranceiver")
mem = cpu.connection( 0x03,"Memory chip")
if mem.get("FREQ") == None: freq = 12345 ; mem.store("FREQ ",12345)
class Main:
cpu.reg_event(r adio.receive, self.event_Mess age)
cpu.reg_event(t erminal.input, self.event_Inpu t)
def event_Message(s elf,message):
terminal.write( message + "\r\n")
def event_Input(sel f,data):
if data[0] == "/":
if string.upper(st ring.split(data[1:]))[0] == "CHANNEL":
radio.setFreq(i nt(string.split (data)[2]))
mem.store("FREQ ",int(string.sp lit(data)[2])
else:
radio.send(data )
---
I see the following problems:
1. looping code
Are there any way to avoid this by checking the "eip" within a usercode?
Is it possible to multiplex between user codes to avoid this?
Is it possible to limit execution speed (set the cpu to 5 instructions
pr second)
2. blocking code / untrusted/insecure code
Is there a effective way to limit the available functions the usercode?
(perhaps like the java securityhandler way)
3. memory-dos
Limiting the storage size (or even forcing the user to store EVERYTHING
in the mem object)
I dont know if this is even possible (without modifying the python
source, which would force me to perhaps seperate server code and user code)
Comment