Menu
I'm writing a collaborative project designed to allow code contributions from users. Users will be able to extend a class, add functionality etc, and submit the code back to the server for regular execution.
Is there a safe way to execute users' PHP code? A foolproof sanitizing method? What about infinite loops? Or should I offer a different scripting language?
977
PHP is a server side scripting language. This means that it is executed on the server. The client applications do not need to have PHP installed.
The preferred way of running PHP files is within a web server like Apache, Nginx, or IIS—this allows you to run PHP scripts from your browser. That's how all PHP websites work! The other way is to run PHP scripts on the command line, and it doesn't require you to set up a web server.
A PHP code will run as a web server module or as a command-line interface. To run PHP for the web, you need to install a Web Server like Apache and you also need a database server like MySQL. There are various web servers for running PHP programs like WAMP & XAMPP.
Until version 3, PHP source code was parsed and executed right away by the PHP interpreter. PHP 4 introduced the the Zend engine. This engine splits the processing of PHP code into several phases. The first phase parses PHP source code and generates a binary representation of the PHP code known as Zend opcodes.
JailRoot for the DocumentRoot
SafeMode ON to allow access to files only on specific directories
Use a per USER MPM to limit system
resources to the apache process
Set safe php.ini settings for memmory limit and max_execution_time
And as Saggi Malachi noted, this is very experimental, you have to monitor the actions on the server and have fallback szenarios, eg. cronjobs watching load average, if loadaverage is above threshold stop apache and sendmail.
Other good idea is to compile your own php und deny access to php functions which could be "exploited" by your users.
190
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
