Server Questions (2 of them)

[Andrew]

Hello List,

How to do you create a server that accepts a set of user code?

For example,

I would like to send this function:
def addition(x,y):
return x+y
and have the socket server perform the operation and send is back to
the end user.

Question 2:
On that same server, I want a user to be able to pass a file to the
server along with code. What is the best way to pass file to the
server?


Thank you for any suggestions or resources you can provide.

Andrew

 

[Chris Angelico]

Hello List,

How to do you create a server that accepts a set of user code?

For example,

I would like to send this function:
def addition(x,y):
  return x+y
and have the socket server perform the operation and send is back to
the end user.

Question 2:
On that same server, I want a user to be able to pass a file to the
server along with code.  What is the best way to pass file to the
server?

The easiest way is to write an HTTP server (Python has some tools that
will make this easy) and use an HTML form, which can do file uploads
as well as accept keyed-in code.

However, you will run into some fairly major security issues. You're
accepting code across the internet and running it. Python does not
protect you against malicious users reading files from your hard disk
or, worse, modifying those files. This sort of thing can ONLY be used
in a trusted environment - a local network on which you know
everything that's happening.

ChrisA

 

[Hrvoje Niksic]

How to do you create a server that accepts a set of user code?

[...]

Look up the "exec" statement, the server can use it to execute any code
received from the client as a string.

Note "any code", though; exec runs in no sandbox and if a malicious
client defines addition(1, 2) to execute os.system('sudo rm -rf /'), the
server will happily do just that.

 

[alex23]

It's possible to sandbox Python code, see
http://docs.python.org/library/rexec.html

Although this has been deprecated since 2.6 & removed from 3.x (and
cautioned against for as long as I've used Python).

PyPy provides some sandboxing functionality that might be useful here:
http://codespeak.net/pypy/dist/pypy/doc/sandbox.html