Recently, I found out about another project which uses Python scripting: Phil Hassey is working on public python bots for his game Galcon, and he does it by simply severely restricting the standard Python interpreter, to a degree that it seems 100% safe. The method is similar to the mentioned restricted python from the Zope project, but much simpler (and much more restricted). Anyway, I want to try using his code for Wesnoth.
Some of the restrictions (yes, they are severe):
no import (but possibility to make external stuff available, e.g. the wesnoth module)
no exceptions (scripts need to check return values, no big problem)
no builtin functions (can't use setattr or type or eval or file..)
no access to internals (no access to .__dict__ or .__class__ or .__name__..)
The result of course is not really Python anymore, only a very simple scripting language with Python syntax. But it means, the current Python code can be kept (also can continue to allow use of the full Python interpreter for signed scripts). And this restricted scripting language still is very nice I think, nicer than e.g. Lua.
Of course, there is no 100% guarantee for security. But then, there isn't for WML either, a real hacker might find ways to execute arbitrary code from a WML script.
Anyway, since some more python users besides me are reading this forum, I wanted to hear some opinions about it, or if someone even can see an obvious attack point in Phil Hasseys's code (which is attached).
Just put safe.py, test.py and script.py in a directory, and run it with "python test.py". Then see if you can do something unsafe inside script.py (it already has some hello world code which can be deleted). E.g. adding an "import", "file" or "eval" statement will immediately refuse to execute with an exception from the safe.py module.. and so should any other malicious use.
