This question already has answers here:
Closed 10 years ago.
Possible Duplicate:
Python, safe, sandbox
I'm building a corporate web system in Python which allows scripts to be uploaded and run serverside. Given I'm already developing in Python and its such a nice simple language, it seems like a good language to write the scripts in. However, there is a security hazard there, I want to block all function calls except a limited subset. Is there a mechanism I can use to do this, or some other technique? Do I need to use something else, Lua perhaps? I'm developing in Pyramid/Pylons.
This is a terrible idea, but just to let you know about the option:
You could sanitize a string that contains the Python code (and by sanitize I mean you need to do like a few hundred malicious unit tests and heavily test that the sanitation is adequate) with RegEx to only match the function calls you want and then call eval() on the string.
Related
This question already has answers here:
How do I protect Python code from being read by users?
(29 answers)
Closed 3 years ago.
My project is open sourced, except for a single module where I don't want people to know the implementation. Actually, I don't mind one or two people cracking the thing open if they are determined enough, but I want most to give up at the first sight.
I only want the implementation of that single module to be hidden, the interface still fully usable if people want to contribute to the project. That is to say, I want people to be able to do things like:
import my_hidden_module
my_hidden_module.do_stuff()
My project mostly runs on Windows so Windows-exclusive suggestions are ok.
I'm totally new to this hiding code thing so I don't know where to start. It would be appreciated if someone could give me a direction to look into.
1) You can use classes and private variables or
2) use name =='main', but that will not implement the code on interface
3) looks dumb but you can comment on top of that function to not to be CHANGED
else you can see - How do I protect Python code?
I have a Python project that dynamically loads Python scripts from a set of specified directories and executes an expected function off of them. To harden the security of this application, I would like to analyze the scripts to ensure that they are just pure math functions and, therefore, not interacting with any system components such as the HDD/SDD, the network, a database, etc. Is this even possible to do in Python?
This question has been moved to https://security.stackexchange.com/questions/131283/how-does-one-verify-that-a-python-script-is-a-pure-math-function, but I'm leaving this here, for now, to keep the comments and answers that have already been provided.
It appears that sandboxing to disable things like I/O, network etc.. isn't fully reliable.
Since Python doesn't have any permission system embedded, it'll be pretty hard to do what you want.
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 4 years ago.
Improve this question
The standard way to test VHDL code logic is to write a test bench in VHDL and utilize a simulator like ModelSim; which, I have done numerous times.
I have heard that instead of writing test benches in VHDL, engineers are now using Python to test there VHDL code.
Questions:
How is this done?
Is this done by writing a test bench in Python and then compiling this Python file or linking into Modelsim?
Is this done in Python using a module like myHDL and then linking/importing your VHDL file into Python? Is so, how is the timing diagram generated?
When writing a test bench in Python can you use standard Python coding/modules or just a module like myHDL?
For example if I want to test a TCP/IP stack in VHDL, can I use the socket module in Python to do this (i.e. import socket)?
Is there a reference, paper, or tutorial that shows how to do this? I've checked the Xilinx, Altera, and Modelsim websites but could not find anything.
The only thing I find online about using Python for FPGA are a few packages: with myHDL being the most referenced.
Why Python is good for this
Python is an efficient language for writing reference models in or to process and verify output files of your testbench. Many things take much less time to program in Python than in a VHDL testbench.
One key feature of Python that makes it so suitable is the automatic usage of big integers. If your VHDL uses >64 bit widths, it can be tedious to interface with that in other languages. Also when verifying arithmetic functionality, e.g. Python's Decimal package is a convenient tool to build high-precision references.
How can this be done?
This is an example that does not rely on any other software tools.
A straightforward practical way to interface Python is via input and output files. You can read and write files in your VHDL testbench as it is running in your simulator. Usually each line in the file represents a transaction.
Depending on your needs, you can either have the VHDL testbench compare your design outputs to a reference, or read the output file read back into a Python program. If using files takes too long, at least in Linux it's easy to set up a pipe with mkfifo that you can use as if it were a file, and you can then have your Python program and simulator read from and write to in sync.
Using standard Python modules
With the method I described, you'll have to find a way to separate whatever that module is doing into a stream of data or raw transactions. Unfortunately for your example of a TCP/IP stack, I see no straightforward way to do this and it would probably require significant clarification to discuss further.
More information
Several useful things are linked to in the comments above, especially the link posted by user1155120: https://electronics.stackexchange.com/questions/106784/can-you-interface-a-modelsim-testbench-with-an-external-stimuli
Maybe it is better to design whole design in some other language like SystemC/myHdl/HWToolkit test it and then only export it to your target language.
In order to simulate HDL and drive it from regular python code you have to use framework like cocotb/PyCoRAM and others. Still it gets complicated really fast.
One of the best approaches I have found is to use simulator + agents with queues/abstract memory and in code work only with this queues and not simulator or model itself. It makes writing of testbenches/verification simple.
In python-hw word only HWToolkit currently uses this approach:
tx_rx_test.py
You could write IO from python to text files and use your traditional File-IO VHDL methods to stimulate the DUT.
But, you are better off performing verification in a native environment using a language that was developed to perform functional verification. Using Systemverilog and the Modelsim superset packaged as "Questa Prime" (if you have access to it) is much better.
Assuming you want your python file(s) to be a part of your real-time simulation in terms of transfer functions and/or stimulus generation, they will need to be converted to shared-object files. everything else is post-processing, and is not simulator dependent. e.g. writing output files for later comparison. Non-native simulations, using shared object files, require access via VPI/VLI/FLI/PLI/DPI (depending on what language/tool you are using) which then introduces the overhead of passing the kernel back and forth across the interface. i.e. stop sim, work external, run sim, stop sim, etc.
Systemverilog (IEEE-1800) was developed for IC designers, by IC designers to address the issue of functional verification. while I am all for re-use in terms of .so files from system engineering simulations, if you are writing the testbench (which you shouldn't write your own TB, but that is another discussion), you would be better off using SV given all the built-in functions for constraining stimulus generation, functional coverage and reporting via UCDB.
you should have a reference manual in your Modelsim install to describe using the Programming Interface. you can learn more here : https://verificationacademy.com/ but, it is highly SV-centric... Unfortunately, VHDL is not a verification language, even with the additions they have made to be more like SV, it is, still, better categorized as a modeling language.
Check out PyVHDL. It integrates Python and VHDL with an Eclipse GUI with editing, simulation and VCD generation & display.
GUI Image: https://i.stack.imgur.com/BvQWN.jpg
This question already has answers here:
Closed 10 years ago.
Possible Duplicate:
Call python function from MATLAB
Is there a way to call functions in a Python script from MATLAB, and if so, how?
You're trying to do something non-trivial. Matlab doesn't have any binding of Python-scripts, and also I don't know of a really good substitute. You can choose between two roads, maybe one can help you a little bit (though both are non-trivial, just as your task):
Convert to Python
In nowadays, Python is a valid substitute for most use cases of Matlab. There are libraries for munerical calculations, scientific routines, a great plotting library and a fantastic community that will try to help you with all your problems. And, it's free.
If you only have a couple of Matlab scripts running or you just started using Matlab I'd recommend consideringa a change of platform. To convert your existing Matlab-scripts, you could try the Open Matlab-Python-Converter.
Create a webservice using Python and access it from Matlab
The cleanest way to execute Python-Code from Matlab is to setup a webservice with Python and call this webservice from Matlab. This sounds really complicated, but it isn't. For small projects, I'd recommend XML-RPC. You can look at my other post to see an example of a small XML-RPC-server. If your methods exist, it'Ss easy to adapt to your needs, just import these methods and offer them as webservice calls.
On the Matlab side, you must stick to third-party tools for connecting to an XML-RPC server, e.g., Apache XML-RPC jars.
It might become complicated when you want to pass in other variables than primitives, e.g., arrays. I have no experience how well this works.
I need to store source code for a basic function in a database and allow it to be modified through an admin interface. This code will take several numbers and strings as parameters, and return a number or None. I know that eval is evil, so I need to implement a safe way to execute a very basic subset of python, or something syntactically similar at least, from within a python based web-app.
The obvious answer is to implement a DSL (Domain Specific Language), however, I have no experience with that, nor do I have any idea where to begin, and a lot of the resources available seem to go a little over my head. I'm hoping that maybe there is something already out there which will allow me to essentially generate a secure python-callable function from a string in a database. the language really only needs to support assignment, basic math, if/else, and case insensitive string comparisons. any other features are a bonus, but I think most things can be done with just that, no need for complex data structures, classes, functions, etc.
If no such thing currently exists, I'm willing to look into the possibility of creating one, but as I said, I have no idea how to go about that, and any advice in that regard would be appreciated as well.
Restricted Python environments are hard to make really safe.
Maybe something like lua is a better fit for you
PySandbox might help. I haven't tested it, just found it linked elsewhere.
You could use Pyparsing to implement your DSL, provided the expressions involved won't be too complex (you don't give full details on that but you imply the requirements are pretty simple). See the examples page including specifically fourFn.py or simpleCalc.py.
You could implement a subset of Python by using the ast module to parse Python code into an abstract syntax tree then walk the tree checking that it only uses the subset of Python that you allow. This will only work in Python 2.x since Python 3 has removed the ast module.
However even using this method it will be hard to create something that is 100% secure, since even the most innocuous code could allow the user to write something that could blow up your application, e.g. by allocating more memory than you have available or putting the program into an infinite loop using all the CPU.