How about Python itself?
For example:
>>> import code
>>> def host_func():
... print("Hello old chap!")
...
>>> c = code.compile_command("print(\"Script says hello!\"); host_func()")
>>> exec(c)
Script says hello!
Hello old chap!
exec
let's you be explicit about what from the host environment you want to expose through the two optional parameters locals
and globals
.
In this example I am being explicit about what globals the script will have access to. Note that I can "create" variables here, or give existing functions another name. It's a dictionary pointing to functions and data.
>>> import code
>>> def secret():
... print("What?! I don't even... get out of here.")
...
>>> def public():
... print("Hello stranger.")
...
>>> c = code.compile_command("secret(); public()")
Calling this with globals containing two functions, pointing back to the already existing ones gives:
>>> exec(c, {"secret": secret, "public": public})
What?! I don't even... get out of here.
Hello stranger.
Now when I omit secret
, the script can no longer find it.
>>> exec(c, {"public": public})
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<input>", line 1, in <module>
NameError: name 'secret' is not defined
Here I redefine secret
all together:
>>> exec(c, {"public": public, "secret":lambda: print("Haha! Doppelganger.")})
Haha! Doppelganger.
Hello stranger.
As lazyr mentions in the comments there are security concerns. The above examples let the script pretty much do what it want. In some cases this is not acceptable.
There is some stuff one can do to discourage it:
- Neuter
__builtins__
, only allow "white-listed" built-in functions.
- Make it hard to import modules.
For example, here's how you bork the import
statement (in Py2.* builtins is __builtins__
):
>>> import builtins
>>> def no_import(*args, **kwargs):
... raise ImportError("I cannot let you do that, Dave.")
...
>>> builtins.__import__ = no_import
>>> import os
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<stdin>", line 2, in no_import
ImportError: I cannot let you do that, Dave.
From this follows that we can pass our own builtins
in the globals parameter:
>>> import code
>>> evil_code = "import os; import stat; os.chmod(\"passwords.txt\", stat.S_IROT
H);"
>>> compiled = code.compile_command(evil_code)
>>> def no_import(*args, **kwargs):
... raise ImportError("I cannot let you do that, Dave.")
...
>>> exec(compiled, {"__builtins__": {"__import__": no_import}})
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "<input>", line 1, in <module>
File "<stdin>", line 2, in no_import
ImportError: I cannot let you do that, Dave.
A caveat, though, this will bork all imports that happen after it. It may be better to replace it with a version that lets you import whitelisted modules.
And finally, I'm not sure this completely guards you. Some crafty person may well circumvent it. But the most blatant infractions should at least be discouraged.