limited python virtual machine (WAS: Another scripting language implemented into Python itself?)

[Steven Bethard]

Michael Spencer wrote:
> Steven Bethard wrote:
> 
>> Michael Spencer wrote:
>>
>>> Safe eval recipe posted to cookbook:
>>> http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/364469
>>
>> This recipe only evaluates constant expressions
>
[snip
> 
> Indeed.  But it's easy to extend this to arbitrary constructs.  You just 
> need to decide what code to emit for the other 50 or so ast node types.  
> Many of those are boiler-plate binops.

Ahh, gotcha.  Thanks for the clarification.

I haven't ever spent much time dealing with Python's ASTs, but my guess 
is doing anything here is probably worth putting off until the AST 
branch is merged into main CVS for Python 2.5.  (I understand there are 
supposed to be some substantial changes, but I don't know exactly what 
they are or what they affect.)

> Right - the crux of the problem is how to identify dangerous objects.  
> My point is that if such as test is possible, then safe exec is very 
> easily implemented within current Python. If it is not, then it is 
> essentially impossible.
> 
[snip]
> 
> It might still be possible to have a reliable test within a 
> problem-specific domain i.e., white-listing.

Yeah, that was basically my intent -- provide a white-list of the usable 
objects.  I wonder how complicated this would be...  You also probably 
have to white-list the types of all the attributes of the objects you 
provide...

Steve