From: andrew mcelroy <sophrinix@...>
Date: 2010-01-29T06:48:10+09:00
Subject: Re: Sandbox options?

On Thu, Jan 28, 2010 at 3:15 PM, Donald Ball <donald.ball@gmail.com> wrote:
> I'm interesting in providing my clients the ability to upload
> expressions that I can evaluate to determine the values of various
> components of some business calculations. Eval'ing the expressions is
> the simplest solution, but it's of course unsafe. Can anyone help me
> flesh out my list of options:
>
> 1. Why's sandbox, which has been forked on github but doesn't seem to
> be undergoing ongoing maintenance:
> http://github.com/Sophrinix/sandbox, and thus will probably be a
> problem once ruby-1.9 rolls around
>
I wouldn't call that production software yet. I will add that to the
readme to night.
Not that it is unstable, but rather that I haven't tested it as much
as I need to.

> 2. Write my own parser and interpreter - any ruby libraries that would
> be particularly helpful in this regard?
>
On TryRuby I am using FakeFS to handle any File related operations,
and there is a bit of a sandbox built into that code.

Infact, running a copy of try ruby wouldn't be a bad idea.
As long as you know how load a ruby cgi file in apache/your favorite
web browser.

Another approach could be hotruby (which runs entirely client side in
javascript)
>
> - donald
>

Andrew McElroy
TryRuby.org
github.com/Sophrinix
>