Python from Python restricting functionality

Question

I'm building a corporate web system in Python which allows scripts to be uploaded and run serverside. I'm using Python as it is a simple language to write the scripts in. However, there is a security hazard there, I want to block all function calls except a limited subset. Is there a mechanism I can use to do this, or some other technique? Do I need to use something else like Lua?

Please help me with this.

Answer 1

This doesn't seem like a good idea but you can try the following:

You could sanitize a string that contains the Python code (and by sanitize I mean you need to do like a few hundred malicious unit tests and heavily test that the sanitation is adequate) with RegEx to only match the function calls you want and then call eval() on the string.