limit eval to caller local variables

[FangQ]

hi

I don't know if this is possible in perl. Basically, I had a cgi script
written in perl (based on UseModWiki), I want to allow users to define
customized rules to automatically modify the associated wiki pages.
These rules are defined in a normal wiki page, and are read and
executed (use eval() ) when user browse other wiki pages that are
associated with this rule file.

my question is, since users can write any valid perl script in these
rule files, I don't know if there is a way to limit the variables that
users can modify, say only those within the caller. I also don't want
user to do any file io operations. is this possible with eval?

a simpler but similar example can be found for $EarlyRules and
$LateRules, see
http://www.usemod.com/cgi-bin/wiki.pl?LateRules
and the actual eval is in sub EvalLocalRules() in
http://www.usemod.com/wikicode/usemod10.tar.gz

thanks

Qianqian

 

[Sumo Wrestler (or just ate too much)]

[...] since users can write any valid perl script in these
rule files, I don't know if there is a way to limit the variables that
users can modify, say only those within the caller. I also don't want
user to do any file io operations. is this possible with eval?
[...]

TCL has a feature called Safe-TCL that allows you to create restricted
execution environments (called slave interpreters) where you can remove
commands and variables. By default, the most risky commands are removed
in "untrusted" interpreters. That is something outside of Perl that you
might look into.

Within Perl, there are some modules on CPAN that have the word "safe" in
them. Perhaps they can help you.

 

[Ala Qumsieh]

my question is, since users can write any valid perl script in these
rule files, I don't know if there is a way to limit the variables that
users can modify, say only those within the caller. I also don't want
user to do any file io operations. is this possible with eval?

Not sure exactly, but the closest thing I know of is Safe. 'perldoc
Safe' for more info.

--Ala

 

[Ilya Zakharevich]

[A complimentary Cc of this posting was sent to
FangQ

my question is, since users can write any valid perl script in these
rule files, I don't know if there is a way to limit the variables that
users can modify, say only those within the caller. I also don't want
user to do any file io operations. is this possible with eval?

To protect agains a benign code doing unexpected things, there is a
Safe module. If the environment is hostile, it is more or less
impossible to protect against in the current Perl.

Hope this helps,
Ilya