PyPy.js: Python in the web browser

Re:PyPy.js: Python in the web browser by Alupis on Wednesday August 22, 2018 @12:41PM (#17819972)

Didn't we decide a long while back that fully featured programming languages were dangerous in the browser, especially if they could do disk I/O? Even if sandboxed? A la Java Applets and Adobe Flash?

    import os 
    for subdir, dirs, files in os.walk('./'): 
        for file in files: 
          print file 
          os.remove(file)

Perhaps the environment is "fake", and these files don't really exist, even in some sandbox... otherwise, seems like this might pose a security risk.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by lucb1e on Wednesday August 22, 2018 @01:13PM (#17820202)

This is Javascript, not real Python. If you're so afraid that this is dangerous, why do you post malicious code? And if you're so clever to post that code, why don't you try similar code to see if it really has access to your files?

    import os
    os.listdir('/')

The answer, by the way, is no.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by Alupis on Wednesday August 22, 2018 @01:36PM (#17820374)

> If you're so afraid that this is dangerous, why do you post malicious code?

That's not malicious code... it removes files from a sandbox... you can refresh the page and see for yourself.

> And if you're so clever to post that code

There's no need to be rude... there's an honest question and lack of understanding in my post - educate me, don't talk down to me.

> why don't you try similar code to see if it really has access to your files

The question was if someone could break out of a sandbox, such as with Java Applets and Adobe Flash. I have no idea how to do that - I'm not a security specialist, nor some sort of hacker guy.

> The answer, by the way, is no.

From the sandbox and using the standard `import os`, ya, you're right. The question, again, is what if someone got outside the sandbox?

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by lucb1e on Wednesday August 22, 2018 @03:45PM (#17821458)

Thanks for the elaborate response, now I much better understand what you're trying to say.

This is different from the examples you mention: there is no external software that creates the sandbox (whereas with Java and Flash you had to install those as plugins). It's really just Javascript as it is built into the browser. Any vulnerability in this "sandbox" is a vulnerability in the browser, not some 3rd party plugin.

Put differently, this pypy emulation is no different from the Javascript API that was in your browser already. This isn't a new plugin, just using Javascript to emulate Python through the Pypy interpreter.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by Macha on Wednesday August 22, 2018 @01:41PM (#17820420)

Well why doesn't this apply to JS? The python interpreter is running in the JS sandbox

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by Alupis on Wednesday August 22, 2018 @01:51PM (#17820500)

I suppose that was the explanation I was looking for.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by Klathmon on Wednesday August 22, 2018 @12:43PM (#17819996)

I don't know about PyPy.js specifically, but most systems like this provide a virtual filesystem that maps back to things like indexedDB and localstorage which are browser APIs.

There is no way that pypy.js is able to access local files on your machine outside of the browser sandbox.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by chillydawg on Wednesday August 22, 2018 @12:57PM (#17820093)

I bet there's a few cheeky hackers around the world who may disagree with that statement. Always assume it's broken.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by russx2 on Wednesday August 22, 2018 @01:39PM (#17820393)

No, not in this case. It's running in JS land in the browser so any exploits to break out of the browser sandbox using this could be done simpler with raw JS.

[ Parent | on HN ]

Re:PyPy.js: Python in the web browser by star-techate on Wednesday August 22, 2018 @12:51PM (#17820046)

1. I'll copy&paste this to test it!

2. uh ok I'll paste it into an editor and remove the added indentation and then copy&paste that to test it

3. ... ok. I'll look at the code and reformat every single line and copy&paste that

the oldest complaint abides

[ Parent | on HN ]