I'm speaking specifically of something like the PLT Scheme make-evaluator.
It will run scheme code, but under certain conditions:
- It only uses a definable amount of memory, and will quit execution if the script needs more
- It behaves similarly with time
- It restricts all IO except for what I specifically allow in the code
Is anyone familiar with开发者_如何学编程 anything else that can do this?
Lua lets you easily define sandboxes with as much or as little power you want.
PHP allows something similar with eval - though you would need to set some restrictive values with ini_set before calling it, and they would affect the current script as well.
The Java platform provides fine-grained access control and sandboxing.
This isn't exactly equivalent to make-evaluator
but the API allows you to place constraints on arbitrary objects (through the GuardedObject class). You can also restrict permissions of classes loaded from a particular source.
It might be helpful to read the Java Platform Security Architecture spec
Please note that Java APIs can be accessed from most languages on the jvm.
精彩评论