Re: [Jython-dev] Safe Jython?

[Jeremy H. <je...@zo...>]

>>>>> "FB" == Finn Bock <bc...@wo...> writes:

  FB> [M. Ranganathan]
  >> Can I restrict an imbedded jython interpreter in the same fashion
  >> that I can restrict an imbedded python interpreter. Do I have to
  >> resort to the java.security properties to do this? If there is a
  >> better way, I would appreciate a tip on how to proceed.

  FB> The best way (IMO) is to use a security manager. Simply because
  FB> the java security manager feature have been put through more
  FB> testing and review than any similar feature we could add to
  FB> jython.

One limitation of this approach is that you can't restrict access to
anything written in Python.  One of the chief limitations of Python for
security is that you don't have any access controls on instances.  A
private name (__name) is just as accessible as any other name.  Adding
some coarse access controls if one of the features of rexec.

I suppose you could write a generic wrapper object in Java and use it
to wrap Python objects.

Jeremy