3

I recently came across a cool site for testing .NET code (http://dotnetfiddle.net/). In the FAQs they mention that they have two restrictions for security purposes:

  • No access to File System IO
  • No external internet access

Is this sufficient to prevent malicious users from exploiting the site? Is there anything that a malicious user could still do even with these restrictions in place?

4

Is there anything that a malicious user could still do even with these restrictions in place?

It depends on your definition of "malicious". Running a tight loop or otherwise consuming huge amounts of resources is arguably malicious. Serving up a fake PayPal front is malicious, but certainly not prevented by these features.

You pick the level and type of insecurity you're willing to tolerate based on the features you feel you need. And then over time you might adjust based on usage.

  • According to their FAQ, they limit running code to 5 seconds of execution time and 200KB of memory usage before terminating, which may mitigate some of the resource DoS potential. – Xander Nov 20 '13 at 19:05
3

They seem to have taken fairly reasonable precautions. You can still reflect over the assemblies loaded in the AppDomain, so if you had time to poke through them, you might (or might not) find something in their custom assemblies that was interesting and exploitable, but it looks to me like the model is essentially what you'd get with a shared web host (plus the reasonable restriction of no file system or Internet access) and that model has been used to reasonably successfully isolate applications from each other and the host for many years now.

As I mentioned in my comment on Tyler's answer, they've also implemented some controls to prevent applications from mounting DoS attacks on the service, such as limiting application runtime to 5 seconds, and application memory to 200KB.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.