[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [pygame] Scripting language



Ok, as far as I understand now you want to let players changing their Avatars over a script language via Internet. Hmmm, nice feature letting players create their own scripts. Well, Im not a security guy but letting others use any (script) language that is technically able to access the directory structure of the system is risky. Whether its Python or any other not self written language you want to offer to you users I only see the following options:

- The user scripts are running on a exposed machine
- The user rights are strongly restricted
- The script language you offer to players is limited in its functionality (checking commands of players must be done then)


Maybe it already helps if you dont allow certain import functionalities (specially no direct disk access).

Greetings
Farai



Am 19.12.2006 um 00:05 schrieb Brandon N:

Hello Farai,
  I prefer to not dismiss Python as simply a scripting language. :p

Anyway, I am using Python as the development language for both the client and server in a project I am working on. Now, I want to be able to expose certain functionality for scripting other than the internal development kind I have been doing with Python. That is, users can write scripts that affect the behavior of their avatars in the world.

I do not want to expose Python itself (at least, the same environment that the server is running in) because it seems relatively easy to reach outside of one's module in Python to muck with internal settings. I certainly cannot check for every piece of unsafe code and users will not have the server source so as to easily engineer such a thing, but it seems safer to just use something external and expose only the objects and methods I choose to allow.

Thanks,
  Brandon


On Dec 18, 2006, at 5:51 PM, Farai Aschwanden wrote:

Hello Brandon

Maybe I missunderstand you but Python IS a scripting language. What is your intention using Python?

Farai


Am 18.12.2006 um 22:53 schrieb Brandon N:

Hello all,
This is not strictly a pygame question though it does relate to my use of pygame in general. What have people used for scripting languages in Python? I suppose I could use Python itself but I do not want to expose anything through the use of eval or otherwise (currently I am doing just about this). While I do not want to write a language from scratch, I do have a simple Lisp implementation that I could expose.


If this is way too off-topic I'll try to find another place to ask.

Cheers,
  Brandon