• Stars
    star
    187
  • Rank 206,464 (Top 5 %)
  • Language
    Ruby
  • License
    GNU General Publi...
  • Created over 14 years ago
  • Updated over 4 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

shikashi is a ruby sandbox that permits the execution of "unprivileged" scripts by defining the permitted methods and constants the scripts can invoke with a white list logic

Shikashi - A flexible sandbox for ruby

Shikashi is an sandbox for ruby that handles all ruby method calls executed in the interpreter to allow or deny these calls depending on the receiver object, the method name, the source file from where the call was originated and the source file where the called method is implemented.

The permissions for each sandboxed run is fully configurable and the implementation of the methods called from within the sandbox can be replaced transparently

The implementation of shikashi is written in pure ruby and now implemented based in evalhook, (see http://tario.github.com/evalhook)

Installation

Gem installation

Run in the terminal:

sudo gem install shikashi

OR

sudo gem install shikashi-X.X.X.gem.

Troubleshooting

ERROR:  While executing gem ... (Gem::DependencyError)
    Unable to resolve dependencies: ruby2ruby requires sexp_processor (~> 3.0); ruby_parser requires sexp_processor (~> 3.0)

The version of ruby2ruby and ruby_parser required depends on sexp_processor 3.X but for some reason this version of the gem is not automatically installed by gem, you can workaround this issue by installing it before using:

gem install sexp_processor --version '~> 3.2'

Documentation

Full API documentation can be found on: http://tario.github.com/shikashi/doc/

Usage

This examples and more can be found in examples directory

Basic Example

Hello world from a sandbox

	require "rubygems"
	require "shikashi"

	include Shikashi

	s = Sandbox.new
	priv = Privileges.new
	priv.allow_method :print

	s.run(priv, 'print "hello world\n"')

Basic Example 2

Call external method from inside the sandbox

	require "rubygems"
	require "shikashi"

	include Shikashi

	def foo
		# privileged code, can do any operation
		print "foo\n"
	end

	s = Sandbox.new
	priv = Privileges.new

	# allow execution of foo in this object
	priv.object(self).allow :foo

	# allow execution of method :times on instances of Fixnum
	priv.instances_of(Fixnum).allow :times

	#inside the sandbox, only can use method foo on main and method times on instances of Fixnum
	s.run(priv, "2.times do foo end")

Basic Example 3

Define a class outside the sandbox and use it in the sandbox

	require "rubygems"
	require "shikashi"

	include Shikashi

	s = Sandbox.new
	priv = Privileges.new

	# allow execution of print
	priv.allow_method :print

	class X
		def foo
			print "X#foo\n"
		end

		def bar
			system("echo hello world") # accepted, called from privileged context
		end

		def privileged_operation( out )
			# write to file specified in out
			system("echo privileged operation > " + out)
		end
	end
	# allow method new of class X
	priv.object(X).allow :new

	# allow instance methods of X. Note that the method privileged_operations is not allowed
	priv.instances_of(X).allow :foo, :bar

	priv.allow_method :=== # for exception handling
	#inside the sandbox, only can use method foo on main and method times on instances of Fixnum
	s.run(priv, '
	x = X.new
	x.foo
	x.bar

	begin
	x.privileged_operation # FAIL
	rescue SecurityError
	print "privileged_operation failed due security error\n"
	end
	')

Basic Example 4

define a class from inside the sandbox and use it from outside

	require "rubygems"
	require "shikashi"

	include Shikashi

	s = Sandbox.new
	priv = Privileges.new

	# allow execution of print
	priv.allow_method :print

	#inside the sandbox, only can use method foo on main and method times on instances of Fixnum
	s.run(priv, '
	class X
		def foo
			print "X#foo\n"
		end

		def bar
			system("ls -l")
		end
	end
	')

	x = s.base_namespace::X.new
	x.foo
	begin
		x.bar
	rescue SecurityError => e
		print "x.bar failed due security errors: #{e}\n"
	end

Base namespace

	require "rubygems"
	require "shikashi"

	include Shikashi

	class X
		def foo
			print "X#foo\n"
		end
	end

	s = Sandbox.new

	s.run( "
	  class X
		def foo
			print \"foo defined inside the sandbox\\n\"
		end
	  end
	  ", Privileges.allow_method(:print))
	  

	x = X.new # X class is not affected by the sandbox (The X Class defined in the sandbox is SandboxModule::X)
	x.foo

	x = s.base_namespace::X.new
	x.foo
	
	s.run("X.new.foo", Privileges.allow_method(:new).allow_method(:foo))

Timeout example

	require "rubygems"
	require "shikashi"

	s = Shikashi::Sandbox.new
	perm = Shikashi::Privileges.new

	perm.allow_method :sleep

	s.run(perm,"sleep 3", :timeout => 2) # raise Shikashi::Timeout::Error after 2 seconds

Copying

Copyright (c) 2010-2011 Dario Seminara, released under the GPL License (see LICENSE)

More Repositories

1

fastruby

Fastruby, fast execution of ruby code (please, killme)
Ruby
19
star
2

imageruby

flexible and easy to use ruby gem for image processing
Ruby
16
star
3

evalhook

Alternate eval which hook all methods executed in the evaluated code
Ruby
9
star
4

quadnet

Quadnet remake project with new actual technologies of web, play the game here: http://tario.github.io/quadnet/
JavaScript
8
star
5

rallhook

Allow hooking of all method invocations transparently to control and / or monitor the behavior of a ruby program
C
5
star
6

imageruby-bmp

Provides the encoder and decoder for images in bmp format for imageruby
Ruby
3
star
7

partialruby

Ruby partial interpreter written in pure-ruby
Ruby
2
star
8

picotest

Test pico framework. Write entire test suites in a few lines
Ruby
2
star
9

microruby

Minimalist ruby interpreter made from scratch
C
2
star
10

evalmimic

Evalmimic allow the implementation of eval like methods, solves the common problem of binding retrieve: in ruby you can\'t obtain the binding of the caller, or if you can, is some tricky
2
star
11

AjScript-migrated

Git miagrated version of Angel "Java" Lopez AjScript project (from http://ajcodekatas.googlecode.com/svn/trunk/AjScript)
C#
1
star
12

fixedquake

Fork of quake sdk package originally created by ID Software with fix of compiling issues
C
1
star
13

ruby_openid_test

Ruby
1
star
14

imageruby-devil

Bridge between ImageRuby and Devil image library
Ruby
1
star
15

to_erb

Haml to erb conversion tool
Ruby
1
star
16

imageruby-bmp-c

Provides the encoder and decoder for images in bmp format for imageruby (C version)
C
1
star
17

dslisprb

Lisp interpreter written in ruby
Ruby
1
star
18

shikashi_heroku_test

Ruby
1
star
19

ruby-cymbol

Resolv libruby.so exports and debug symbols to relative offsets
Ruby
1
star
20

m3u8test

Test for m3u8
1
star
21

pl0_infinite

PL/0 Compiler written in javascript
JavaScript
1
star
22

imageruby-c

C-Ruby extension to increase performance of imageruby by replacing methods of the API with C implementations
C
1
star
23

devise_openid_test

Test of devise auth gem using openid
Ruby
1
star
24

openid-auth-sample

sample of openid authentication using rails
Ruby
1
star
25

rails_oauth_test

Basic test of rails oauth_plugin
Ruby
1
star
26

define_method_handler

Chain of responsability implementation in a ruby fashion way
Ruby
1
star
27

rails-negai-plugin

Rails plugin for synchronous and asynchronous execution of ruby scripts using negai gem
Ruby
1
star
28

sorairo

Web application that allows the creation and execution of ruby scripts in a secure way (using a sandbox)
Ruby
1
star
29

analisisnumerico_tp1

Ruby
1
star
30

rsimplex

Simplex solver made on pure ruby
1
star
31

negai

Ruby execution enviroment that includes sandboxed execution of scripts and irb, and debugging tricks
Ruby
1
star
32

music.js

Music.js, status: Proof of Concept
JavaScript
1
star
33

getsource

Get the source file path of the implementation of a given method
Ruby
1
star
34

sdctasks

fork of Southworks SDC Tasks for MSBuild
C#
1
star
35

omniauth_test

Basic test of omniauth features, providers mainly google, twitter and github
Ruby
1
star
36

scriptffolding

Rails plugin for easy and minimalist edition of scripts with scaffolding pattern
JavaScript
1
star
37

shikashi-shikashi

Privileges package and emulation to use the shikashi API from within a shikashi sandbox (sandbox inside of sandbox)
Ruby
1
star
38

git-testing

git test sandbox
1
star
39

twitter-demo

Hello World spike of twitter button using the genial tweet-button plugin https://github.com/intridea/tweet-button
Ruby
1
star