Giter VIP home page Giter VIP logo

jruby-sandbox's Introduction

JRuby Sandbox

Build Status

The JRuby sandbox is a reimplementation of _why's freaky freaky sandbox in JRuby, and is heavily based on javasand by Ola Bini, but updated for JRuby 1.7.

Prerequisites

This gem was developed against JRuby 1.7.6, and is known to work with 1.7.8, but has not been tested against other versions, so proceed at your own risk. The Travis CI configuration specifies the jruby-19mode target, which floats between exact versions of JRuby. At the time of writing, this is currently JRuby 1.7.8. You can see a list of Travis CI's provided rubies here. As long as the build is green you should be good to go.

Installing JRuby is simple with RVM:

rvm install jruby-1.7.6

Building

To build the JRuby extension, run rake compile. This will build the lib/sandbox/sandbox.jar file, which lib/sandbox.rb loads.

Basic Usage

Sandbox gives you a self-contained JRuby interpreter in which to eval code without polluting the host environment.

>> require "sandbox"
=> true
>> sand = Sandbox::Full.new
=> #<Sandbox::Full:0x46377e2a>
>> sand.eval("x = 1 + 2") # we've defined x in the sandbox
=> 3
>> sand.eval("x")
=> 3
>> x # but it hasn't leaked out into the host interpreter
NameError: undefined local variable or method `x' for #<Object:0x11cdc190>

There's also Sandbox::Full#require, which lets you invoke Kernel#require directly for the sandbox, so you can load any trusted core libraries. Note that this is a direct binding to Kernel#require, so it will only load ruby stdlib libraries (i.e. no rubygems support yet).

Sandbox::Safe usage

Sandbox::Safe exposes an #activate! method which will lock down the sandbox, removing unsafe methods. Before calling #activate!, Sandbox::Safe is the same as Sandbox::Full.

>> require 'sandbox'
=> true
>> sand = Sandbox.safe
=> #<Sandbox::Safe:0x17072b90>
>> sand.eval %{`echo HELLO`}
=> "HELLO\n"
>> sand.activate!
>> sand.eval %{`echo HELLO`}
Sandbox::SandboxException: NoMethodError: undefined method ``' for main:Object

Sandbox::Safe works by whitelisting methods to keep, and removing the rest. Checkout sandbox.rb for which methods are kept.

Sandbox::Safe.activate! will also isolate the sandbox environment from the filesystem using FakeFS.

 >> require 'sandbox'
 => true
 >> s = Sandbox.safe
 => #<Sandbox::Safe:0x3fdb8a73>
 >> s.eval('Dir["/"]')
 => ["/"]
 >> s.eval('Dir["/*"]')
 => ["/Applications", "/bin", "/cores", "/dev", etc.]
 > s.activate!
 >> s.eval('Dir["/*"]')
 => []
 > Dir['/*']
 => ["/Applications", "/bin", "/cores", "/dev", etc.]

Known Issues / TODOs

  • There is currently no timeout support, so it's possible for a sandbox to loop indefinitely and block the host interpreter.

jruby-sandbox's People

Contributors

adamfortuna avatar omghax avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

jruby-sandbox's Issues

Some ppl (me) need a section indicating how to properly install the gem

Hey, first off great work on this gem if i'm understanding the readme correctly. This is exactly what I need to setup a cool flashcard style ruby and rails mental refresher app. It will be fun and have colors!

Ok, so I followed the compile process, and that zany .jar file sure enough showed up in the lib directory, but then I had to really stretch my ruby thought muscles and run the command rake install to install the gem. But it would turn out that... that doesn't even work because when I try to require in sandbox, ruby returns with a load error in irb.

Edit:

I was forgetting to require 'rubygems'.

All eval'd code is run in Ruby 1.9 mode regardless

$ jruby --1.8 -S irb
jruby-1.6.7.2 :001 > require 'rubygems'
 => true
jruby-1.6.7.2 :002 > require 'sandbox'
 => true
jruby-1.6.7.2 :003 > Sandbox::Full.new.eval("{new_hash_syntax: true}")
 => {:new_hash_syntax=>true}
jruby-1.6.7.2 :004 > {new_hash_syntax: true}
SyntaxError: (irb):4: syntax error, unexpected ':'

This is causing problems because my app and the gems it uses currently run in 1.8 mode only.

The offending line in SandboxFull.java:38

cfg.setCompatVersion(CompatVersion.RUBY1_9);

Safe eval escapes sandbox

I'm able to circumvent the sandbox by using a referenced namespace/module. Here's an example:

jruby-1.6.7 :001 > require 'sandbox'
 => true 
jruby-1.6.7 :002 > Foo = Struct.new(:foo)
 => Foo 
jruby-1.6.7 :003 > sand = Sandbox::Safe.new
 => #<Sandbox::Safe:0x2221bcd5> 
jruby-1.6.7 :004 > sand.activate!
 => ["%", "*", "+", "<<", "<=>", "==", "=~", "capitalize", "capitalize!", "casecmp", "center", "chomp", "chomp!", "chop", "chop!", "concat", "count", "crypt", "delete", "delete!", "downcase", "downcase!", "dump", "each", "each_byte", "each_line", "empty?", "eql?", "gsub", "gsub!", "hash", "hex", "include?", "index", "initialize", "initialize_copy", "insert", "inspect", "intern", "length", "ljust", "lines", "lstrip", "lstrip!", "match", "next", "next!", "oct", "replace", "reverse", "reverse!", "rindex", "rjust", "rstrip", "rstrip!", "scan", "size", "slice", "slice!", "split", "squeeze", "squeeze!", "strip", "strip!", "start_with?", "sub", "sub!", "succ", "succ!", "sum", "swapcase", "swapcase!", "to_f", "to_i", "to_s", "to_str", "to_sym", "tr", "tr!", "tr_s", "tr_s!", "upcase", "upcase!", "upto", "[]", "[]="] 
jruby-1.6.7 :005 > sand.ref Foo
 => nil 
jruby-1.6.7 :006 > sand.eval 'Foo.eval "`ls /etc/passwd`"'
 => "/etc/passwd\n" 
jruby-1.6.7 :007 > 

Shouldn't that be disallowed in the safe mode?

Note: Plain ls is not defined.

jruby-1.6.7 :007 > sand.eval '`ls`'
Sandbox::SandboxException: NoMethodError: undefined method ``' for main:Object
        from sandbox/SandboxFull.java:60:in `eval'
        from (irb):7:in `evaluate'
        from org/jruby/RubyKernel.java:1088:in `eval'
        from org/jruby/RubyKernel.java:1410:in `loop'
        from org/jruby/RubyKernel.java:1197:in `catch'
        from org/jruby/RubyKernel.java:1197:in `catch'
        from /home/jsimpson/.rvm/rubies/jruby-1.6.7/bin/jirb:17:in `(root)'
jruby-1.6.7 :008 > 

Sandbox_spec.rb fails. My JRuby_Sandbox is not safe and lets through all "system" commands.

https://gist.github.com/rayning0/7718769

What's wrong? I've tried everything I could, but my JRuby_Sandbox still lets through all "system" commands. My sandbox_spec.rb is failing.

Even though I followed the instructions on using JRuby_Sandbox, it is not secure and not only letting through commands on the whitelist. I did:

require 'sandbox'
s = Sandbox.safe
s.activate!

Screen output is Sandbox::Safe:0x0f108c18, followed by a big list of whitelisted commands

s.eval("system('ls')") STILL WORKS!
s.eval %{echo HELLO} STILL WORKS!
It still lets me delete and create directories on my filesystem. FakeFS seems to load, yet system commands are not being performed on a fake directory, but on my actual directory.

Add license

I didn't see a license in the repo. Is it MIT licensed like javasand?

Way to capture output (puts) inside sandbox

I'd like to be able to capture and display the stdout used in the sandbox. Is this something I can access on the sandbox itself?

In regular ruby, I can do this to capture stdout.

    s = StringIO.new                                                                                                          
    $stdout = s
    result = yield
    @output = s.string
    result
  ensure
    $stdout = STDOUT

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.