Recommendations for sandboxing inside PHP5 or alternatives? [closed]

Question

I've been slowly working on a personnel project to run a webmud like game using extjs as my frontend. One of the design choices I made was to allow user-generated evaluated code for game logic. So when the player enters a new "room" a number of state scripts would be called along the lines of "has player been here before, should they be here, do they have x inventory item" and then respond accordingly. Furthermore basic room "actions" would be hard coded ( go N/S/E/W ) but advanced actions would be available as the same user-generated evaluated scripts.

Originally I was going to be lazy and use evaluated PHP for this logic, but my paranoid sense is kicking in. So the two alternatives I have found is the runkit_sandbox but it doesn't support an interchange of objects between the primary thread and the sandbox ( just simple data types and arrays) OR using ecmascript as my game logic http://ejohn.org/blog/spicing-up-embedded-javascript/.

The pro/cons of the two is that with runkit, I can lock the script down pretty hard at a tremendous cost to speed while the ecma interpreter would allow me to selectively bind variables, functions, and possibly objects to the javascript run space but its still in beta state and I've yet to see how well it runs.

Is these it for options or is there something else out there I don't know about that might be a better choice? Environment: linux, PHP-CGI 5.3 or as a google app engine.

Answer 1

I wouldn't recommend evaluating user-contributed PHP-code -- even within a runkit sandbox. PHP is a very complex language, and it's closely tied to its environment. Without knowing the specifics, I would anticipate that there are numerous holes that people could leverage to break out of the sandbox.

There are other languages, that you can embed, than javascript. Lua is a popular choice for these kinds of things. There is even a php extension in pecl, with bindings for it.

If you're going the runkit route anyway, you could look into a shared memory solution, such as memcache, for exchanging data between processes.

Answer 2

There is a PHP Sandbox for basic stuff available. It's early stages but looks promising.

http://www.phpclasses.org/package/7015-PHP-Execute-external-PHP-scripts-in-a-separate-process.html

or from GitHub: https://github.com/fregster/PHPSandbox

Paul