I am generating dynamic images in a web service. The current setup is:
image.pydoes a database lookup to determine what data to use to generate the image
image.pycalls a sub-script (given by the database; e.g.,
cats.py) to generate the particular image
image.py contains standard wrapper code, and
cats.py draws cats (
dogs.py would naturally draw dogs). I would like to generalize this setup so that users can supply their own plotting code, subject to my pre-provided variables—chiefly the plotting canvas and the
Allowing generic Python scripts to be uploaded is of course a substantial security concern. I would like to keep my server under my control, and avoid it being used to blast spam across the Internet; hosing the server with loops and large data structures is also a concern, but to my knowledge there's not much to do about that (please prove me wrong!).
Will the following measures be sufficient to guard against the most flagrant forms of abuse?
image.pyas a user with limited permissions (to avoid users obtaining critical server information)
- Disable key functions such as
exec, etc.—by setting them equal to
None—to limit capabilities to a controlled environment (to avoid users importing network libraries and other things with nasty potential)
I am destroying the database object and all critical variables prior to calling potential user scripts. One challenge is that I am returning Python errors when they exist, by modifying the content-type of the returned document. This might allow inspection of certain properties, but is also necessary to permit debugging.
I have found these related questions, but I'm not certain they're directly related:
Update: I see from testing that
__import__ = None does not actually disable the
import keyword. So maybe this concept won't work.