.NET DLR safe or sandboxed script

Question

I am using the DLR within a small part of a larger C# project, IronPython being the language in question.

For some parts of the system the user is able to enter a small script to customise behaviour for them. What I would like to do is to be able to restrict them to using side-effect free pure functions or in some sort of sandbox so that their function cannot touch anything outside.

Also, the user only can enter a function body, the function header and argument specification is automatically pre-pended in code before being passed to the Python DLR engine so that the C# side of the system that calls it knows exactly the args to pass and what is coming back. The users will only ever require to do simple operations and tests based purely on values supplied as arguments.

e.g.

this is ok: return (a * 100) > b;

this is not ok: delete_file_system(); return (a * 100) > b;

How might this be achieved? Is there a more appropriate language or technology choice?

Answer 1

The way to do this is to create a sandboxed app domain and then run the script in the that app domain. You can find directions on creating the sandboxed domain here: http://msdn.microsoft.com/en-us/library/bb763046.aspx

To run the code in the app domain you can use the Python.CreateEngine overload which accepts an AppDomain. Then all of the code executed in that engine will run in that app domain.

If you want to have user code call back into your host you can create a class which derives from MarshalByRefObject and put it in the scope for them to access and call back. The calls will go through to your normal app domain and you can do everything you'd normally be able to do.

There's also a bunch of APIs on the ObjectOperations and ScriptScope the classes which work with ObjectHandles for performing operations on objects in the remote domain.