Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:6664
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <01c601c3c80a$173eddd0$8802a8c0@obsidian>
To: "Christian Schneider" <cschneid@cschneid.com>,
	=?iso-8859-1?Q?ing.Martin_Pr=E1sek?= <prasek@silesia.cz>
Cc: "Lukas Smith" <smith@backendmedia.com>, <internals@lists.php.net>
References: <006501c3c6f2$9002e540$d300a8c0@webpropag.cz> <php.internals-6649@news.php.net> <3FE494B9.7090501@cschneid.com> <000b01c3c7e2$cc9ec780$d300a8c0@webpropag.cz> <3FE5EC3B.9060506@cschneid.com>
Date: Sun, 21 Dec 2003 21:33:33 -0000
Organization: The Brain Room Ltd.
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Extending PHP  with sandbox capability ?
From: wez@thebrainroom.com ("Wez Furlong")

A real sandbox mechanism is not likely to be implemented, at least,
not for a very long time.

Having needed something like this myself for a commercial project
in the past, I settled on a "user-space sandbox" using the tokenizer
extension to parse the code and filter out unsafe functions, rewrite
"new" statements to prevent instantiation of certain classes, rewrite
access to global variables and so on.

Unfortunately, I don't own the code, so I cannot make it available.
However, the thing to remember is that you can never make it 100%
secure if you are executing anything that came from outside of your
program.

--Wez.