Adding to this, because I abandoned work on my module-white-listing sandboxing project after related research and feedback from BEAM creators, and am linked in these links:
There is no reliable way to prevent arbitrary user-supplied code from invoking functions inside particular modules on the BEAM, and simply parsing the AST of user-supplied code cannot protect you from all attack vectors.
There are simply too many M/F/A calling eval equivalents that power essential spawning mechanics to be able to enforce that user code not access the host’s file system, network, or compute resources.
The BEAM was designed to execute functions against any connected node’s resources by design, and so arbitrary-calling-mechanics are core to its function. As such, running any untrusted Elixir/erlang/BEAM code must be done in resource-constrained environments to ensure hygiene and safety.
