Re:Show HN: Game where you write Python robots to fight othe...
by jsmeaton on Saturday November 02, 2013 @05:34AM
(#6658665)
Holy shit, that article was brilliant. A few of those tricks I was aware of ( __class__.__class__ ), but crafting code objects? I need to re-read this a few times to properly grok how it works.
I find things like this absolutely fascinating.
If they can't do it....
At any rate it is certainly not as simple as that, and not only is it not as simple as that, it is not even close to being that simple.
In fact, I recall warning people off of this exact project many years ago on comp.lang.python.
This seems up-to-date: https://wiki.python.org/moin/Asking%20for%20Help/How%20can%2... It looks like the only even remotely feasible option is PyPy, and this link doesn't look like much fun: https://pypi.python.org/pypi/RestrictedPython/ It looks to me like you'd still have many, many opportunities to end up with holes in the system.
I really, really don't recommend Python for this.
You might find this interesting: http://blog.delroth.net/2013/03/escaping-a-python-sandbox-nd... (And before you go "Oh, I've got that blocked"... read it, like, really really read it, not just skim for "one thing I can do to block that stuff", but to see just how many things there are in Python for this sort of hackery. Personally I'd guess the "I blocked double-underscores" would not have slowed them down much.)