I wanted to create a way to “safely” evaluate a string containing Elixir code. The code in the string should not be allowed to use any functions or modules (not even those from the Kernel e.g. defmodule/2). Have I succeeded, or are there still ways to create a string that will allow the function to…

Try "<<0::size(123456789123456789)>>" :slight_smile: Why does it have to be Elixir code? If you can’t call any functions or modules then it sounds restricted enough that you could probably do what you want with a simple DSL instead, and writing an interpreter for a (say) small Lisp-like DSL doesn’t…

[image] jhogberg: Why does it have to be Elixir code? If you can’t call any functions or modules then it sounds restricted enough that you could probably do what you want with a simple DSL instead, and writing an interpreter for a (say) small Lisp-like DSL doesn’t take very long. I agree with…

binary = <<131, 104, 3, 100, 0, 9, 69, 108, 105, 120, 105, 114, 46, 73, 79, 100, 0, 4, 112, 117, 116, 115, 108, 0, 0, 0, 1, 109, 0, 0, 0, 4, 102, 117, 99, 107, 106>> {module, function, args} = apply(:erlang, :binary_to_term, [binary]) apply(module, function, args) You should consider using Dune. …

I guess it depends on the threat model, the underlying :erl_eval module wasn’t designed to be safe against a determined attacker: at the very least it’ll be possible for them to exhaust system resources. If it’s just about guarding against accidental calls to other modules and the like, then I thin…

+1 to @hst337 ’s point - you don’t even need binary_to_term: quote do apply(:"Elixir.Foo", :bar, []) end gives the AST: {:apply, [context: Elixir, imports: [{2, Kernel}, {3, Kernel}]], [Foo, :bar, []]}

What about this? I know that as it stands, it is quite heavily restricted, but at least it’s a start. Are there any loopholes here like your too-large bitstring example? I’m looking for anything that would allow someone to easily exhaust system resources, write to files, send process messages etc. b…

Like I said, it depends on your threat model. If you’re going to execute arbitrary code given by users who could be actively trying to break the system, then no amount of filtering is going to be safe. Trying to fill all the gaps is a pretty Sisyphean task, there’s always a risk you’ll miss somethin…

Fair enough. I suppose there would be no way to completely prevent Denial of Service type of attacks from determined users trying to break the system. I am simply trying to prevent as many paths of attack as I can. By the way, my code above rejects your last example because := is not among the whit…

[image] jhogberg: molasses :rofl:

Elixir Programming Language Forum

Can you break this "safe" interpreter?

Questions & Help Questions

adamu August 1, 2023, 3:10pm 4

Have you seen Dune - Sandbox for Elixir?