JRuby DSL封装，不包括标准库

Question

I'm trying to make a Java program that allows users to do some limited scripting with a Ruby DSL that I've written. The script the user writes is saved to a Proc object in JRuby. The problem arises in that the user can still access methods that are standard to Ruby, such as File.new , or creating classes, or basically messing with other internal logic of the program or computer.

Is there a way to limit the user's script to only the constraints of the DSL, using JRuby or Ruby or even Java? Or at least to remove the user's access to certain classes?

Answer 1

Since you're running under JRuby, you can use a Java security policy ( policy file documentation ) to prevent users from being able to do things like file or network I/O. Of course, this will keep your code from having those capabilities, too! You can whitelist code by jar URI or by jar signature, so one tactic is to create a "hull" of trusted code that strongly validates its input, package it in its own jar, trust it, and use it exclusively for your own code. Doing this right gets complicated fast (have an extensive test suite!), but it can be done.

To have explicit control over the namespace available to your DSL, you can use BasicObject . It doesn't mix in Kernel or any of the other things available in the standard Ruby namespace. This doesn't give you security , though, because users can still use ::File directly or include ::Kernel to get it all back!