允许用户注入并运行 php 代码的最佳方式
我一直在思考允许用户在网站上注入代码并在网络服务器上运行它的想法。这不是一个新想法 - 许多网站允许用户在线“测试”他们的代码 - 例如 http://ideone.com/。
例如： 假设我们有一个包含
我的问题是：如何正确地做到这一点？我们应该考虑的事情[以及可能的解决方案]：
- 安全，不允许用户做任何邪恶的事情，
- php.ini 的 disable_functions
- 稳定性, 用户不允许终止提交 while(true){} 的网络服务器，
- 性能，服务器返回在可接受的时间内回答，
- 控制，用户可以做任何与前面的点相匹配的事情。
我更喜欢面向 PHP 的答案，但也欢迎一般方法。先感谢您。
I've been thinking for a while about the idea of allowing user to inject code on website and run it on a web server. It's not a new idea - many websites allow users to "test" their code online - such as http://ideone.com/.
For example: Let's say that we have a form containing <textarea> element in which that user enters his piece of code and then submits it. Server reads POST data, saves as PHP file and require()s it while being surrounded by ob_*() output buffering handlers. Captured output is presented to end user.
My question is: how to do it properly? Things that we should take into account [and possible solutions]:
- security, user is not allowed to do anything evil,
- php.ini's disable_functions
- stability, user is not allowed to kill webserver submitting while(true){},
- performance, server returns answer in an acceptable time,
- control, user can do anything that matches previous points.
I would prefer PHP-oriented answers, but general approach is also welcome. Thank you in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我会在网络服务器之外的更高层次上思考这个问题。有一个非常无特权的、被监禁的、chroot 的独立进程来运行这些上传的 PHP 脚本，那么无论启用或不启用哪些 PHP 函数，它们都会因权限和缺乏访问而失败。
有一个父进程监视上述“工作”进程运行了多长时间，如果太长，则终止它，并向最终用户报告超时错误。
显然，关于如何在浏览器请求之外异步运行该系统，还有许多实现细节需要解决，但我认为它将提供一种非常安全的方式来运行不受信任的 PHP 脚本。
I would think about this problem one level higher, above and outside of the web server. Have a very unprivileged, jailed, chroot'ed standalone process for running these uploaded PHP scripts, then it doesn't matter what PHP functions are enabled or not, they will fail based on permissions and lack of access.
Have a parent process that monitors how long the above mentioned "worker" process has been running, if its been too long, kill it, and report back a timeout error to the end user.
Obviously there are many implementation details to work out as to how to run this system asynchronously outside of the browser request, but I think it would provide a pretty secure way to run your untrusted PHP scripts.
禁用服务器 ini 文件中的功能是否会限制应用程序本身的某些功能？
我认为你必须对 POST 数据进行一些硬核清理并删除其中的“非法”代码。我认为通过添加您描述的其他方法可能会使其发挥作用。
只要记住。净化 POST 数据中的永恒日光。
Wouldn't disabling functions in your server's ini file limit some of the functions of the application itself?
I think you have to do some hardcore sanitization on the POST data and strip "illegal" code there. I think doing that with the addition of the other methods you describe might make it work.
Just remember. Sanitize the everloving daylight out of that POST data.