News for hackers. Stuff that matters.

A comment on /story/34772586. Parent comment

Re: by avinassh on Tuesday February 14, 2023 @12:12PM (#34792493)
> The script is running in the VM on the api service and does not provide any IO functions.

Thank you for answering! but I am still not sure how can you prevent someone importing io lib in go or js and writing to a file.

> Just like the functions provided by the playground page, users can fill in any code, so I must ensure that it cannot write functions that can harm the server.

can you tell me more on how are you ensuring this?

[ Parent | on HN ]
Re: by vanishs on Tuesday February 14, 2023 @07:23PM (#34798284)
python, Lua and JS These functions are implemented by these packages:

github.com/dop251/goja

github.com/yuin/gopher-lua

go.starlark.net

Go scripts (programs) are not subject to any restrictions. So there is no Go script support in the playground(debug)

[ Parent | on HN ]
Re: by avinassh on Wednesday February 15, 2023 @06:44AM (#34802554)
Thank you so much! This explains how they are run. I will explore these repositories.
[ Parent | on HN ]
Re: by vanishs on Wednesday February 15, 2023 @07:05AM (#34802701)
thank you for discussing with me
[ Parent | on HN ]