That you can filter our from the python source code or replace such call with exception ("bzz, can't load AddReference") - Yeah, it's a pretty nasty workaround, but it works.<br><br>Dody G.<br><br><div class="gmail_quote">
On Mon, Jun 30, 2008 at 3:26 PM, Michael Foord <<a href="mailto:fuzzyman@voidspace.org.uk">fuzzyman@voidspace.org.uk</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">Dody Gunawinata wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
In the IronPython hosting API, unless you specifically load the assembly, it will not be accessible through the script. So right now restricting access means configuring the assemblies you want to expose to the script.<br>
<br>
</blockquote>
<br></div>
But what is to stop the user code doing:<br>
<br>
import clr<br>
clr.AddReference('SomeAssembly')<br>
<br>
Loading the ScriptRuntime into an AppDomain and restricting the privileges on that is one way - but I don't think that IronPython will work at all unless the AppDomain has pretty much full trust.<br>
<br>
Michael Foord<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">
On Mon, Jun 30, 2008 at 3:09 PM, Ben Hall <<a href="mailto:ben2004uk@googlemail.com" target="_blank">ben2004uk@googlemail.com</a> <mailto:<a href="mailto:ben2004uk@googlemail.com" target="_blank">ben2004uk@googlemail.com</a>>> wrote:<br>
<br>
I thought this last night, it would be really useful if we could<br>
'sandbox' the IP engine and limit it's access to certain areas of the<br>
framework.<br>
<br>
<br>
<br>
On Mon, Jun 30, 2008 at 12:57 PM, Rainer Worbis<br></div><div><div></div><div class="Wj3C7c">
<<a href="mailto:r.worbis@cubido.at" target="_blank">r.worbis@cubido.at</a> <mailto:<a href="mailto:r.worbis@cubido.at" target="_blank">r.worbis@cubido.at</a>>> wrote:<br>
> No - for example i would like to prevent that the user loads<br>
assemblies and does own data access via System.Data.SqlClient.<br>
> Or uses specific parts of the applications. (which should be<br>
visible to other scripts). So access control per script would be<br>
optimal.<br>
><br>
> Rainer<br>
><br>
> -----Ursprüngliche Nachricht-----<br>
> Von: <a href="mailto:users-bounces@lists.ironpython.com" target="_blank">users-bounces@lists.ironpython.com</a><br>
<mailto:<a href="mailto:users-bounces@lists.ironpython.com" target="_blank">users-bounces@lists.ironpython.com</a>><br>
[mailto:<a href="mailto:users-bounces@lists.ironpython.com" target="_blank">users-bounces@lists.ironpython.com</a><br>
<mailto:<a href="mailto:users-bounces@lists.ironpython.com" target="_blank">users-bounces@lists.ironpython.com</a>>] Im Auftrag von<br>
Korbinian Abenthum<br>
> Gesendet: Montag, 30. Juni 2008 13:47<br>
> An: Discussion of IronPython<br>
> Betreff: Re: [IronPython] restrict scripting access<br>
><br>
> Rainer Worbis wrote:<br>
>> is there a way to restrict access to objects or namespaces<br>
>> within a script? We use IronPython for providing scripting<br>
>> functionality within our .NET Application but would like to<br>
>> restrict access to certain functions. Has anybody information<br>
>> or a sample how to do that?<br>
><br>
> Can you declare the restricted objects as "internal"?<br>
><br>
> Cheers,<br>
> Korbinian<br>
> _______________________________________________<br>
> Users mailing list<br></div></div>
> <a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a> <mailto:<a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a>><div class="Ih2E3d">
<br>
> <a href="http://lists.ironpython.com/listinfo.cgi/users-ironpython.com" target="_blank">http://lists.ironpython.com/listinfo.cgi/users-ironpython.com</a><br>
> _______________________________________________<br>
> Users mailing list<br></div>
> <a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a> <mailto:<a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a>><div class="Ih2E3d">
<br>
> <a href="http://lists.ironpython.com/listinfo.cgi/users-ironpython.com" target="_blank">http://lists.ironpython.com/listinfo.cgi/users-ironpython.com</a><br>
><br>
_______________________________________________<br>
Users mailing list<br></div>
<a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a> <mailto:<a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a>><div class="Ih2E3d">
<br>
<a href="http://lists.ironpython.com/listinfo.cgi/users-ironpython.com" target="_blank">http://lists.ironpython.com/listinfo.cgi/users-ironpython.com</a><br>
<br>
<br>
<br>
<br>
-- <br>
</div><a href="http://nomadlife.org" target="_blank">nomadlife.org</a> <<a href="http://nomadlife.org" target="_blank">http://nomadlife.org</a>><br>
------------------------------------------------------------------------<div class="Ih2E3d"><br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.ironpython.com" target="_blank">Users@lists.ironpython.com</a><br>
<a href="http://lists.ironpython.com/listinfo.cgi/users-ironpython.com" target="_blank">http://lists.ironpython.com/listinfo.cgi/users-ironpython.com</a><br>
<br>
</div></blockquote><font color="#888888">
<br>
<br>
-- <br>
<a href="http://www.ironpythoninaction.com/" target="_blank">http://www.ironpythoninaction.com/</a><br>
<a href="http://www.voidspace.org.uk/" target="_blank">http://www.voidspace.org.uk/</a><br>
<a href="http://www.trypython.org/" target="_blank">http://www.trypython.org/</a><br>
<a href="http://www.ironpython.info/" target="_blank">http://www.ironpython.info/</a><br>
<a href="http://www.resolverhacks.net/" target="_blank">http://www.resolverhacks.net/</a><br>
<a href="http://www.theotherdelia.co.uk/" target="_blank">http://www.theotherdelia.co.uk/</a><br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br><a href="http://nomadlife.org">nomadlife.org</a><br>