RodolfoSilva
Limit access to dependencies and modules when running Code.eval_quoted_with_env
Hi everyone, I’m developing a project where I will allow users to dynamically edit and execute code. I was wondering if there is any way to limit what the user can do and access. Something like livebook do.
At the moment, the basic implementation I’m using is this:
code = "\"Hello \#{input}\""
quoted = Code.string_to_quoted!(code)
env = Code.env_for_eval([])
binding = [input: "Name"]
{value, _binding, _env} = Code.eval_quoted_with_env(quoted, binding, env, prune_binding: true)
IO.puts(value)
For example, I don’t want users to have access to my application’s modules as Ecto. I need a way to limit the user’s environment and allow him to install dependencies and use only the library installed by him.
Most Liked
zachallaun
I don’t believe Code has utilities for running things in a sandbox.
I’m not an expert in this, but I believe the best practice for these sorts of things is to run the code in a fully sandboxed environment, e.g. a container that you can spin up explicitly for this purpose that is configured with limited resources, no Internet connection, etc.
D4no0
If you need only templating, I would strongly recommend using a templating engine (like mustache), as code generation at runtime is dangerous (access to the system is not the only danger) , there are few other solutions if you need code though:
- using a sandboxed environment like luerl, of course the scripts have to be written in lua, this is fully safe and you have full control over the sandbox;
- if you want specifically to write only elixir, there is Dune, in this case you will lose a part of the language functionality and it is not fully secure, I would avoid using this if your system is exposed to the internet to be accessed by random users, as there might be ways to ddos the system;.
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
We build reliable cloud platforms for business-critical systems.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking for Elixir devs who love to ship. Start your free account.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"