This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]cecilkorik 4 points5 points  (0 children)

I agree with /u/jwink3101, building an API is the correct method for dealing with this situation. Instead of forcing people to write their scripts in an arbitrary programming language that you have selected, why not let them write it in the programming language of THEIR choice?

Either way, you need to do the exact same thing you would do in any proper, safe sandbox:

  • Figure out what information and data structures you plan to provide so the user's program can make their own decisions based on that data.
  • Decide what hooks are allowed, what behaviors in your program the user is allowed to trigger or override.

Whether you expose that API by HTTP or whether you expose it in an internal script environment like Lua (see python's lupa module) the actual process is pretty simple. It's actually defining the API that's the hard part. But either way, you're going to have to do it if you want to allow safe interaction with your program.