How to run user code that might be unsafe?

Question

I am writing a program that will interpret and run some user code written in Javascript in C#. How do I go about running with hard limit in running time?

Answer 1

Running user code; EVER; is not safe (see SQL injection, obligatory reference to XKCD ). There is no way to make it safe (apart from sandboxing, at which point you aren't running their code on your computer any more). See the 10 immutable laws of security ( TechNet )

That said, you could use the overload of Process.WaitForExit that takes an int (MSDN) to "timeout" and kill the process after a time period (10s in the example):

Process myVeryUnsafeProc = new Process();
myVerUnsafeProc.Start();
if (!myVeryUnsafeProc.WaitForExit(10000))
{
   myVeryUnsafeProc.Kill();
}

Note that the javascript could have killed your monitoring process and made this whole exercise pointless. Did I mention you just can't do this safely?