# Domain Specific Language security

**URL:** <https://www.ruby-forum.com/t/domain-specific-language-security/90176>\
**Category:** Rails\
**Created:** [March 26, 2007, 5:11pm UTC](https://www.ruby-forum.com/t/domain-specific-language-security/90176 "2007-03-26T17:11:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmcclean](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/91b2a8/32.png) [@dmcclean](https://www.ruby-forum.com/u/dmcclean)\
**Post date:** [March 26, 2007, 5:11pm UTC](https://www.ruby-forum.com/t/domain-specific-language-security/90176/1 "2007-03-26T17:11:26Z")

</div>

Is there a way to write a DSL which limits the access by a user? Since  
this  
is Ruby, they could write any arbitrary expression such as  
MyModel.delete\_all

My users would not do this on purpose, but perhaps by accident.  
I have read some about Sandboxes, but don’t see how it would  
prevent something like this.

Thanks in advance,  
Don Mc

---

<div class="post-metadata">

**Author:** ![dmcclean](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/91b2a8/32.png) [@dmcclean](https://www.ruby-forum.com/u/dmcclean)\
**Post date:** [March 26, 2007, 5:27pm UTC](https://www.ruby-forum.com/t/domain-specific-language-security/90176/2 "2007-03-26T17:27:36Z")

</div>

On Mar 26, 10:10 am, “Don.Mc” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Is there a way to write a DSL which limits the access by a user? Since  
> this  
> is Ruby, they could write any arbitrary expression such as  
> MyModel.delete\_all
> 
> My users would not do this on purpose, but perhaps by accident.  
> I have read some about Sandboxes, but don’t see how it would  
> prevent something like this.

Sandboxes can be created by setting the Safe Level for your  
application. Ruby has a variable $SAFE which controls the Safe Level.  
To create a sandbox, set up your enviroment using the default Safe  
Level (0) and then raise the Safe Level to 4, the highest level. At  
Safe Level 4 there can be no subsequent changes to the environment.  
This may be more than you want and may limit the effectiveness of your  
DSL. Try it out – see if will work for you.

---

<div class="post-metadata">

**Author:** ![dmcclean](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/91b2a8/32.png) [@dmcclean](https://www.ruby-forum.com/u/dmcclean)\
**Post date:** [March 26, 2007, 5:42pm UTC](https://www.ruby-forum.com/t/domain-specific-language-security/90176/3 "2007-03-26T17:42:38Z")

</div>

Dale,  
Thanks! That is exactly what I needed.

Regards,  
Don McClean

On Mar 26, 10:26 am, “Dale M.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)