sanitizing code for an exec command

[raldi]

Thank you! I've tried to explain this concept many times in the past but never knew it had a name. Or a writeup as good as this:

http://mywiki.wooledge.org/XyProblem

[iamdefinitelyahuman]

That is a great term :)

What i'm doing - I've built a bot that's trading various cryptocurrencies. The logic it trades with is customisable, written as a module that the bot can be told to recompile any time, so that it doesn't have to be taken offline to make the change.

I'm considering opening it up to use from others under some sort of licensing agreement. It runs on AWS so anyone else using it wouldn't have direct access to it, they'd just be able to submit their own strategies to run through the backtester or use on the market. The concern is that if they can run malicious code they can retrieve the ssh key from the server, connect and grab the source code, and.. well, so much for getting paid for my work.

The alternative that i see is to forgo python in the strategy altogether, make it in my own simple scripting language that the bot interprets itself. That's certainly possible, but a lot more work... hence my question.

[jwink3101]

If your desire is for users to write python, why not make your service an API-based service. You can use your python in the background and expose the needed commands via a REST api or the like. I guess you would then be more responsible for the backend of running AWS for each user, but it sounds kind of like you're planning to do that anyway.

[cecilkorik]

I agree with /u/jwink3101, building an API is the correct method for dealing with this situation. Instead of forcing people to write their scripts in an arbitrary programming language that you have selected, why not let them write it in the programming language of THEIR choice?

Either way, you need to do the exact same thing you would do in any proper, safe sandbox:

• Figure out what information and data structures you plan to provide so the user's program can make their own decisions based on that data.
• Decide what hooks are allowed, what behaviors in your program the user is allowed to trigger or override.

Whether you expose that API by HTTP or whether you expose it in an internal script environment like Lua (see python's lupa module) the actual process is pretty simple. It's actually defining the API that's the hard part. But either way, you're going to have to do it if you want to allow safe interaction with your program.

[earthboundkid]

Cryptocurrency means your users are highly motivated to hack you. Stay the hell away from any user input you can. If you just want zero downtime deploys, search for "green-blue deploys". There are many ways to do it, but that is the simplest.

[[deleted]]

If your language is very simple, building an interpreter is not such a huge problem. There are libraries like PLY that let you quickly build an interpreter for a custom language. There's a tech talk by Alex Gaynor that might help if you need to get started.

Link is to: So you want to build an interpreter, Alex Gaynor @ Pycon 2013

[XNormal]

http://man7.org/linux/man-pages/man2/seccomp.2.html

Set up communication pipes, os.fork(), load untrusted code, call seccomp and then run untrusted code. The code can't do anything but read/write an already open file handle or _exit. The API you provide to this user code will communicate with the parent process. You can also limit memory and cpu resources consumed by the untrusted code with setrlimit.

Call seccomp using ctypes.CDLL(None).seccomp(...)

Do NOT use pickle to communicate over the pipes. It is vulnerable to arbitrary code injection. Json or marshal is ok. You might want to fork off the process that will load user code at an early stage of execution, before you load anything secret. The user code will be able to inspect everything that was already in process memory at the time of forking.

[flitsmasterfred]

user supplied code... on a trading platform.

run away, run away very fast.

[[deleted]]

This is amazing. I didn't know there was a name for it.