python - Safe method parsing text files with a user provided script -

-

i'm looking way parse text url has been provided user, parser script has been provided user. eval easy enough, super scary. end goal allow user point server data source , tell server how read data.

what best safest way this? python or node preferred, i'm not limited specific language.

so example. cvs document, i'll have text file. url: http://www.ams.usda.gov/mnreports/lm_xb803.txt

this python script can read file url, , stored on database:

expected_length = 6 requiredfeilds = ['low','high'] requirednonzero = ['low','high']  response = urllib2.urlopen(url) reader = csv.reader(response) grade = none date = none first_row = true keep_list = []  row in reader:     if len(row) != expected_length:         continue      if first_row:         date_text = row[2]     date_object = datetime.strptime(date_text, '%m/%d/%y')     date = date_object.strftime("%y-%m-%d")     first_row = false   row_label = row[0].strip()  row_label = re.sub('\s\s+',' ',row_label) grade_labels = {     'select cuts':'sl',     'choice cuts':'ch',     'choice , select cuts':'slch',     'ground beef':'grnd',     'beef trimmings':'trim' } if row_label in grade_labels.keys():     grade = grade_labels[row_label]     continue  row.insert(0,grade) row.append(date)  # ignore until grade selected if row[0] none:     continue  # check rqs try:     field in requiredfeilds:         if len(row[ormmap[field]]) == 0:             raise exception('required field missing') except:     continue  try:     field in requirednonzero:         if row[ormmap[field]] < 1:             raise exception('required field missing') except:     continue  keep_list.append(row)

i don't know of powerful-enough language can "safely sandboxed" ensure skilled, malevolent user can't damage script (program) or supplies run -- not without os support, is.

fortunately, os support is feasible -- , @ point becomes little relevant language script/program written in.

if spin virtual machine, , run user-supplied program inside bounded resource , close supervision, can make things pretty secure way.

if you're willing trade off assurance of safety less overhead, run user program in bsd jail -- bsd jails have been around long time , matured , proven experience dependable.

linux containers offer similar approach, , promise, haven't been around anywhere long, so, might consider them riskier.

further along spectrum chrome's portable native client, https://developer.chrome.com/native-client , runs user's program (appropriately compiled machine code) in presumably secure sandbox within (chrome) browser.

i'm sure there exist other solutions yet, similar overall approaches, somewhere along vm -> jails/containers -> nacl spectrum or barely outside of it. depending on how overhead can afford, i'd hew close possible "left" (vm) end of spectrum -- rather rely on "supposedly sandboxed" runtime specific language... maybe i'm pessimist this!-)


Comments

Post a Comment

Popular posts from this blog

node.js - Mongoose: Cast to ObjectId failed for value on newly created object after setting the value -

-
this question has answer here: what's mongoose error cast objectid failed value xxx @ path “_id”? 7 answers even though has been asked many times because entity has no valid objectid field. i came across situation objectid set value can casted objectid still error. the schema: var serviceschema = parammongoose.schema({ servicename:{ type: parammongoose.schema.types.objectid , ref: 'servicenames',required:true } }); pseudo code: servicefromdb=new service({servicename:'some name'}); servicefromdb.servicename='000000000000000000000001'; servicefromdb.save(function(paramerror,paramdata){ if(paramerror){ console.log('but but...',servicefromdb,paramerror) } }); the output of code is: but but... { servicename: 000000000000000000000001, _id: 55079a90286f49280364f78b } { [casterror: cast objectid faile...
Read more

[C++][SFML 2.2] Strange Performance Issues - Moving Mouse Lowers CPU Usage -

-
i've been working on making 2d map editor past 2 weeks or so, , i've run strange problem. trying optimize code, example, making functions should've been functions begin with, did made cpu usage go through roof. i've tried commenting out different sections of code thought culprits (scrolling, rendering, other calculations) no avail. think issue might trying call things within different functions, sake of making modular possible, i'd functionality. the other major change i've made since file i'm comparing i've ported variables external cpp file, since having variables global makes lot easier use within different functions. simple issue, can't life of me understand why happens. with original code, around 2-3% cpu usage. new code, around 20-35%, but, if move mouse around, it'll drop around 6-8%. tl;dr: after trying optimize code using functions, i've somehow killed performance, , found strange quirk moving mouse reduces cpu usage.. /...
Read more

ios - Possible to get UIButton sizeThatFits to work? -

-
i have been using method of resizing uibuttons depreciated, , not robust. , other reasons, want sizethatfits work uibuttons. i've read online, i'm not sure if should work (seems working some, not others, difference maybe between style, i'm using custom). here simple test code recreate issue (i put in viewdidload test, shouldn't matter, , real code part of large project): uibutton *btn = [uibutton buttonwithtype:uibuttontypecustom]; [btn settitle:@"this test long title need word wrap more single line when displayed on tiny ipod in portrait view." forstate:uicontrolstatenormal]; btn.titlelabel.linebreakmode = uilinebreakmodewordwrap; // depreciated - nothing replace it? cgrect r = btn.frame; r.origin.x = 0; r.origin.y = 0; r.size.width = 320; r.size.height = [btn.titlelabel.text sizewithfont:btn.titlelabel.font constrainedtosize:cgsizemake(r.size.width,100000) linebreakmode:btn.titlelabel.linebreakmode].height; // returns approx 86 , changes correctly ...
Read more