Re: [Jython-dev] Safe Jython?

[<bc...@wo...>]

[M. Ranganathan]

>Can I restrict an imbedded jython interpreter in the same fashion
>that I can restrict an imbedded python interpreter. Do I have
>to resort to the java.security properties to do this? If there is a
>better way, I would appreciate a tip on how to proceed.

The best way (IMO) is to use a security manager. Simply because the java
security manager feature have been put through more testing and review
than any similar feature we could add to jython.

>Is there some way to restrict loop execution in a jython program
>to a maximum number of iterations?

Generally no. Maybe the trace hooks:

  http://www.python.org/doc/current/lib/module-sys.html#l2h-250

can be abused for this purpose, but I'm sure an evil program can also
defeat that.

Security (in any form) was never in the design spec for jython. Because
of that, jython will never (IMO) be a secure environment.

regards,
finn