On Thu, Mar 8, 2012 at 11:01 AM, kracethekingmaker <kracethekingmaker@gmail.com> wrote:

On 03/09/2012 12:27 AM, Piotr Skamruk wrote:

...

2012/3/8 kracethekingmaker<kracethekingmaker@gmail.com>:

...

Hi PyPyians

 Thanks to your support for making this happen. Especially to fijal, who was patient enough to answer my question.

www.pylive.codespeaks.in, an online python interpreter(strictly pypy

looks like application had bad times... 502 from webserver in front of it...

Sorry, I did some mistake with git stash pop, I apologise. so whole system was corrupted, Thanks for your time. Now system is up. Kindly try.

...

...

interpreter) on top pypy sandboxed version 1.7. Source code of the site is

located @ www.github.com/kracekumar/pylive, just feel free to try and post your feedback, in case pypy community wants any analysis or what kind of code ppl try, I can share with the group, please feel free to comment.

-- "Talk is cheap, show me the code" -- Linus Torvalds Regards Kracekumar.R www.kracekumar.com

_______________________________________________ pypy-dev mailing list pypy-dev@python.org http://mail.python.org/mailman/listinfo/pypy-dev

-- "Talk is cheap, show me the code" -- Linus Torvalds Regards Kracekumar.R www.kracekumar.com

_______________________________________________ pypy-dev mailing list pypy-dev@python.org http://mail.python.org/mailman/listinfo/pypy-dev

Hey you don't correctly escape the output. So a print '<h1>' would do exactly that ;-) Cheers, fijal

Hi

Hi,

On Thu, Mar 8, 2012 at 16:12, Maciej Fijalkowski<fijall@gmail.com> wrote:

...

...

Sorry, I did some mistake with git stash pop, I apologise. so whole system was corrupted, Thanks for your time. Now system is up. Kindly try. It looks like a nice demo :-) The system has limits of 200MB or 60 seconds. For a pypy-sandbox, the only thing that needs to be done carefully is what occurs if a lot of requests come at the same time. Does your demo run only one of them and queue or discard the other ones? Thanks :-) . System has 175MB and 60 seconds timeout as well. I run the flask site using gunicorn, the command goes gunicorn pylive:app --workers=2 --access-logfile /path/to/pylive/app_log.log --error-logfile /path/to/pylive/error_log.log --log-level debug --timeout=120 --daemon --bind=127.0.0.1:46793 --pid=/path/to/pylive/.pid

Currently total worker space is around 50MB for 2 workers, 175 MB for single pypy-sandbox , so 50 + 250MB(300MB), so if server receives more than 2 concurrent request, it should be handled by gunicorn(I might be wrong). Yes there are chances request will get lost, I am working on this area, to separate app and sandbox to different system and introduce queuing system, I will be increasing no of workers as well as memory.

...

you don't correctly escape the output. So a print '<h1>' would do exactly that ;-) Indeed, it's annoying when you try to print e.g. 'sys.modules'. But it's not really a security bug.

I have fixed parsing html tags. Yes its not security bug since its impossible to write to particular location in filesystem and read. The below code also fails with open('a.txt', 'w') as f: f.write('I am hacker') with open('a.txt', 'r') as f: print f.readlines()

A bientôt,

Armin.

-- "Talk is cheap, show me the code" -- Linus Torvalds Regards Kracekumar.R www.kracekumar.com