René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[RFC] Support embedding and sandboxing untrusted code","articleBody":"## Summary\r\n\r\nAs far as I have seen, RustPython is not yet suitable for \"safe\" embedding, meaning that executed Python code can block or hurt the caller code, because:\r\n\r\n- execution can loop forever,\r\n- memory allocation is not bounded,\r\n- import cannot be disabled.\r\n\r\n## Detailed Explanation\r\n\r\nI wish to use RustPython as a scripting language within a game engine, running third-party user code. A requirement for me is that this code is run in a safe way. As far as I have seen (but I might have missed some elements), it is currently not the case:\r\n\r\n- It is not possible to limit code execution up to a maximum number of instructions. Looking into RustPython's source, if I'm not mistaken, this feature would need to be added to `ExecutingFrame` in its [execution loop](https://github.com/RustPython/RustPython/blob/main/vm/src/frame.rs#L347). Maybe the [`ExecutionResult` type](https://github.com/RustPython/RustPython/blob/main/vm/src/frame.rs#L123) could be extended with an `InstructionBudgetExceeded` variant or similar (which could later be expanded to support step by step interactive debugging).\r\n- I couldn't find a way to set limits to heap allocation or stack size, that would also be needed.\r\n- My understanding is that [importlib is always enabled](https://github.com/RustPython/RustPython/blob/main/vm/src/import.rs#L34), but that the OS module is currently disabled in [Wasm32 or Wasi](https://github.com/RustPython/RustPython/blob/main/vm/src/import.rs#L42), is that correct? If so, there should be a way to have finer-control on import lib or even forbid user-defined import statements altogether. Also, I see no reason to link the control of the availability of the `os` module to WASM, maybe a feature flag would be a good addition. Similarly, it should be possible to not enable some [Windows specific code](https://github.com/RustPython/RustPython/blob/main/vm/src/import.rs#L45) and fully disable or controls IOs (including network) and side-effect functions (such as delay) regardless of the target platform.\r\n- Control of the garbage collection would be welcome (#4180), although not critical because one design could be that the RustPython context does not outlive a display frame.\r\n\r\n## Drawbacks, Rationale, and Alternatives\r\n\r\nThe rationale is to use RustPython as an embedding language within larger software, such as game engines. In these, the software must fully control the scripting environment's limits.\r\n\r\nThe main drawback is increased code complexity within RustPython, but I believe it can be done cleanly, with some work of course. The split of the Std library (#3102) was already a step towards the direction of embedding.\r\n\r\nThe alternatives are to not implement this feature, or do it in a fork. A similar issue exists (#3090), but it is more of a question, so I thought an RFC-style new issue is better.\r\n\r\n## Unresolved Questions\r\n\r\nThere are quite some design questions obviously, but I guess first one should agree whether this overall feature makes sense for the project, then the design can be worked out. Probably a unified way to control embedding would be elegant.\r\n","author":{"url":"https://github.com/stephanemagnenat","@type":"Person","name":"stephanemagnenat"},"datePublished":"2022-10-11T09:57:02.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/4210/RustPython/issues/4210"}