Re: Restricted eval

2010-05-06 Thread Heinz N. Gies
On May 7, 2010, at 3:34 , gary ng wrote: > > > On Thu, May 6, 2010 at 10:49 AM, Heinz N. Gies wrote: > If I may :) since I'm the sandbox guy. > > > Is it possible to use the sandbox functionalities without the future/thread > part ? Currently no, if it is really important and the following

Re: Restricted eval

2010-05-06 Thread gary ng
On Thu, May 6, 2010 at 10:49 AM, Heinz N. Gies wrote: > If I may :) since I'm the sandbox guy. > > Is it possible to use the sandbox functionalities without the future/thread part ? Basically, I am trying to create a chatty REPL(say HTTP POST based). the thread would be created by the app conta

Re: Restricted eval

2010-05-06 Thread Rayne
Disabling it is definitely unnecessary. As you said before, we go as far as replacing the '.' special form with our own special safe dot that makes Java interop safe. As a side note, clojurebot doesn't actually use clj-sandbox (yet, hint hiredman, hint), but sexpbot does. _ato hasn't broken sexpbo

Re: Restricted eval

2010-05-06 Thread Heinz N. Gies
On May 6, 2010, at 20:57 , Anniepoo wrote: > Mibu - I've kind of gone around this track as well. > My first reaction to the 'whitelist' was that it was kind of kludgy, > and fought it for a long time, but after a lot of looking for other > ways, I'm with Licenser, it's the best way to do it. Whit

Re: Restricted eval

2010-05-06 Thread Anniepoo
Mibu - I've kind of gone around this track as well. My first reaction to the 'whitelist' was that it was kind of kludgy, and fought it for a long time, but after a lot of looking for other ways, I'm with Licenser, it's the best way to do it. And yes, you have to disable java interop not because yo

Re: Restricted eval

2010-05-06 Thread Heinz N. Gies
If I may :) since I'm the sandbox guy. On May 6, 2010, at 18:18 , Mibu wrote: > I mentioned in the first message that javaop should also be disabled > in a restricted eval. > > On May 6, 5:18 pm, gary ng wrote: >> On Thu, May 6, 2010 at 4:19 AM, Mibu wrote: >&g

Re: Restricted eval

2010-05-06 Thread Mibu
I mentioned in the first message that javaop should also be disabled in a restricted eval. On May 6, 5:18 pm, gary ng wrote: > On Thu, May 6, 2010 at 4:19 AM, Mibu wrote: > > As far as I can tell, clj-sandbox works by a set whitelist of > > arbitrary functions, which is not

Re: Restricted eval

2010-05-06 Thread gary ng
On Thu, May 6, 2010 at 4:19 AM, Mibu wrote: > As far as I can tell, clj-sandbox works by a set whitelist of > arbitrary functions, which is not a very generic approach. It works > for sandboxes like clojurebot, but not for other stuff. > > A restricted eval in all likelihood

Re: Restricted eval

2010-05-06 Thread Mibu
As far as I can tell, clj-sandbox works by a set whitelist of arbitrary functions, which is not a very generic approach. It works for sandboxes like clojurebot, but not for other stuff. A restricted eval in all likelihood will not refer directly to clojure.core, and it's much better allowin

Re: Restricted eval

2010-05-06 Thread Meikel Brandmeyer
Hi, maybe this can help: http://github.com/licenser/clj-sandbox Sincerely Meikel -- You received this message because you are subscribed to the Google Groups "Clojure" group. To post to this group, send email to clojure@googlegroups.com Note that posts from new members are moderated - please be

Restricted eval

2010-05-06 Thread Mibu
So far I have delightfully used Clojure's reader-evaluator-printer to store and load data, as an ad-hoc scripting language and command line interface, as a configuration language, and as an RPC protocol. It's all simple and great when those interfaces are trusted. Now I want to do it with untruste