Sandbox recommendations in PHP5 or alternatives?

I was slowly working on a personnel project to start web mahjong, for example using extjs as my interface. One of the design options I made was to allow user-generated code for game logic. Therefore, when a player enters a new “room”, several status scenarios will be called up line by line “if the player had been here before, should they be here, do they have inventory x”, and then respond accordingly. In addition, the main “actions” of the room will be hardcoded (go to N / S / E / W), but the advanced actions will be available in the form of the same user-created scripts.

Initially, I was going to be lazy and use evaluated PHP for this logic, but my paranoid meaning begins. So the two alternatives that I found are runkit_sandbox, but it does not support exchanging objects between the main thread and the sandbox (just simple data types and arrays) OR using ecmascript as my game logic http://ejohn.org/blog/spicing -up-embedded-javascript / .

The cons / disadvantages of the two is that with runkit I can block the script pretty much at a huge cost for speed, while the ecma interpreter allows me to selectively bind variables, functions and possibly objects with javascript, but it is still located in beta state, and I have not yet seen how it works.

Are they for options or is there something else that I don’t know what might be the best choice? Environment: linux, PHP-CGI 5.3 or as a Google engine.

+1
source share
2 answers

I would not recommend evaluating user-submitted PHP code, even in the runkit sandbox. PHP is a very complex language, and it is closely related to its environment. Without knowing the specifics, I would expect that there are numerous holes that people can use to break out of the sandbox.

There are other languages ​​that you can embed than javascript. Lua is a popular choice for such things. There is even a php extension in pecl with bindings for it.

runkit, , memcache, .

+4

All Articles