Re: Disable certain modules
Jeff Emanuel <[email protected]>
| Newsgroups | gmane.comp.lang.jython.devel |
|---|---|
| Message-ID | <[email protected]> |
See http://alphaloop.blogspot.com/2014/08/sandboxing-python-scripts-in-java.html On 2/13/2015 10:09 AM, Pradeep Badiger wrote: > > Let's see if its more feasible to implement using the Java security manager. > > Also, I will see if I can disable the sys.classloader using del operation without impact. > > Thanks, > > Pradeep V.B. > > *From:*Jeff Emanuel [mailto:[email protected]] > *Sent:* Friday, February 13, 2015 12:01 PM > *To:* Pradeep Badiger; [email protected] > *Subject:* Re: [Jython-dev] Disable certain modules > > > import sys > File = sys.classLoader.loadClass("java.io.File") > > > > On 2/13/2015 9:03 AM, Pradeep Badiger wrote: > > What if I don't allow the user to import just "java". Enforcing user to provide the package that they want to use. > > Thanks, > > Pradeep V.B. > > *From:*Jeff Emanuel [mailto:[email protected]] > *Sent:* Friday, February 13, 2015 12:36 AM > *To:* Pradeep Badiger; [email protected] <mailto:[email protected]> > *Subject:* Re: [Jython-dev] Disable certain modules > > That won't work to deny access to classes in java packages. Consider > > import java > fw = java.io.FileWriter(aFilePath) > > This won't invoke __import__ with java.io as the first argument. I'm not aware of > any way to deny script access to core Java classes. You can limit access to classes > with a custom classloader set on PySystemState, but you'll break internals if you prevent > loading core classes. For instance, the path module uses java.io.File. > > > > On 2/12/2015 5:49 PM, Pradeep Badiger wrote: > > I had to add one more arg to the function. This works for both for the module as well as the package. > > Let me know if this is the correct way to check the modules. > > import__builtin__ > > oldImport = __builtin__.__import__ > > notAllowedImports = [/'java.net'/, /'java.io'/, /'_shutil_'/] > > def*myImport*(*args, **kwargs): > > ifargs[0] innotAllowedImports: > > raiseImportError(/"Import denied - "/+ args[0]) > > returnoldImport(*args, **kwargs) > > __builtin__.__import__ = myImport > > #Test > > # from java.net import Socket > > importshutil > > fromemail.parser importParser > > Thanks, > > Pradeep V.B. > > *From:*Jeff Emanuel [mailto:[email protected]] > *Sent:* Thursday, February 12, 2015 7:17 PM > *To:* Pradeep Badiger; [email protected] <mailto:[email protected]> > *Subject:* Re: [Jython-dev] Disable certain modules > > This works for me on 2.5.3, but I'm not using PyScriptEngine. I use PythonInterpreter directly. Does your 'from' import work > without intercepting __import__? Does it work with a trivial 'myImport' as below? > > >>> import __builtin__ > >>>oldImport = __builtin__.__import__ > >>>def myImport(*args): > ... return oldImport(*args) > ... > >>>__builtin__.__import__=myImport > >>>import uuid > >>>from email.mime.image import MIMEImage > >>>from email.mime.multipart import MIMEMultipart > >>> > >>>print MIMEImage > email.mime.image.MIMEImage > >>>print MIMEMultipart > email.mime.multipart.MIMEMultipart > >>> > >>>import sys > >>>print sys.version > 2.5.3 (2.5:c56500f08d34+, Aug 13 2012, 14:48:36) > [Java HotSpot(TM) 64-Bit Server VM (Oracle Corporation)] > >>> > > > > On 2/12/2015 1:11 PM, Pradeep Badiger wrote: > > I was trying import using "from" syntax and this logic doesn't seem to work. I mean I get import error from oldImport module. > > from email.mime.image import MIMEImage > > from email.mime.multipart import MIMEMultipart > > Exception in thread "main" _javax.script.ScriptException_: ImportError: cannot import name MIMEImage in <script> at line number 122 > > at org.python.jsr223.PyScriptEngine.scriptException(_PyScriptEngine.java:202_) > > at org.python.jsr223.PyScriptEngine.eval(_PyScriptEngine.java:42_) > > at org.python.jsr223.PyScriptEngine.eval(_PyScriptEngine.java:31_) > > Thanks, > > Pradeep V.B. > > *From:*Pradeep Badiger > *Sent:* Thursday, February 12, 2015 2:21 PM > *To:* 'Jeff Emanuel'; [email protected] <mailto:[email protected]> > *Subject:* RE: [Jython-dev] Disable certain modules > > Interesting.. I will see if this fits my requirements. > > Thanks, > > Pradeep V.B. > > *From:*Jeff Emanuel [mailto:[email protected]] > *Sent:* Thursday, February 12, 2015 1:53 PM > *To:* [email protected] <mailto:[email protected]>; Pradeep Badiger > *Subject:* Re: [Jython-dev] Disable certain modules > > I don't know that this is fool-proof, but you can replace __builtin__.__import__ with your own implementation that checks the module name. > > >>> import __builtin__ > >>> oldImport = __builtin__.__import__ > >>> def myImport(*args): > ... if args[0]=='symbol': # Disallowing symbol module > ... raise ImportError("Import denied") > ... return oldImport(*args) > ... > >>> __builtin__.__import__=myImport > >>> import symbol # fails > Traceback (most recent call last): > File "<input>", line 1, in <module> > File "<input>", line 3, in myImport > ImportError: Import denied > >>> import traceback # works > >>> > > On 2/12/2015 8:37 AM, Pradeep Badiger wrote: > > Hi, > > I am trying to disable certain modules which I don't want my users to use. How can I do that? > > I tried del function to delete the module programmatically. But this doesn't work if you import the module again. > > Can someone provide me the pointers? > > Thanks, > > Pradeep V.B. > > > This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately. > > > > > ------------------------------------------------------------------------------ > > Dive into the World of Parallel Programming. The Go Parallel Website, > > sponsored by Intel and developed in partnership with Slashdot Media, is your > > hub for all things parallel software development, from weekly thought > > leadership blogs to news, videos, case studies, tutorials and more. Take a > > look and join the conversation now.http://goparallel.sourceforge.net/ > > > > > > > _______________________________________________ > > Jython-dev mailing list > > [email protected] <mailto:[email protected]> > > https://lists.sourceforge.net/lists/listinfo/jython-dev > > > This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately. > > > This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately. > > > > ------------------------------------------------------------------------------ > > Dive into the World of Parallel Programming. The Go Parallel Website, > > sponsored by Intel and developed in partnership with Slashdot Media, is your > > hub for all things parallel software development, from weekly thought > > leadership blogs to news, videos, case studies, tutorials and more. Take a > > look and join the conversation now.http://goparallel.sourceforge.net/ > > > > > > _______________________________________________ > > Jython-dev mailing list > > [email protected] <mailto:[email protected]> > > https://lists.sourceforge.net/lists/listinfo/jython-dev > > > This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately. > > > This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately. ------------------------------------------------------------------------------ Dive into the World of Parallel Programming. The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Jython-dev mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jython-dev