# Sandbox options?

**URL:** <https://www.ruby-forum.com/t/sandbox-options/182493>\
**Category:** Ruby\
**Created:** [January 28, 2010, 10:15pm UTC](https://www.ruby-forum.com/t/sandbox-options/182493 "2010-01-28T22:15:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dbrady010](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/919ad9/32.png) [@dbrady010](https://www.ruby-forum.com/u/dbrady010)\
**Post date:** [January 28, 2010, 10:15pm UTC](https://www.ruby-forum.com/t/sandbox-options/182493/1 "2010-01-28T22:15:54Z")

</div>

I’m interesting in providing my clients the ability to upload  
expressions that I can evaluate to determine the values of various  
components of some business calculations. Eval’ing the expressions is  
the simplest solution, but it’s of course unsafe. Can anyone help me  
flesh out my list of options:

1. Why’s sandbox, which has been forked on github but doesn’t seem to  
be undergoing ongoing maintenance:  
[GitHub - Sophrinix/sandbox: freaky-freaky security and multiplicity of ruby interps](http://github.com/Sophrinix/sandbox), and thus will probably be a  
problem once ruby-1.9 rolls around

2. Write my own parser and interpreter - any ruby libraries that would  
be particularly helpful in this regard?

3. Marshal the binding and the expression out to a javascript or other  
safe interpreter for evaluation

4. Require the expressions to be blessed by trustees before being  
evaluated

Any other suggestions?

- donald

---

<div class="post-metadata">

**Author:** ![dbrady010](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/919ad9/32.png) [@dbrady010](https://www.ruby-forum.com/u/dbrady010)\
**Post date:** [January 28, 2010, 10:48pm UTC](https://www.ruby-forum.com/t/sandbox-options/182493/2 "2010-01-28T22:48:41Z")

</div>

On Thu, Jan 28, 2010 at 3:15 PM, Donald B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> 

I wouldn’t call that production software yet. I will add that to the  
readme to night.  
Not that it is unstable, but rather that I haven’t tested it as much  
as I need to.

> 1. Write my own parser and interpreter - any ruby libraries that would  
> be particularly helpful in this regard?

On TryRuby I am using FakeFS to handle any File related operations,  
and there is a bit of a sandbox built into that code.

Infact, running a copy of try ruby wouldn’t be a bad idea.  
As long as you know how load a ruby cgi file in apache/your favorite  
web browser.

Another approach could be hotruby (which runs entirely client side in  
javascript)

> - donald

Andrew McElroy  
[TryRuby.org](http://TryRuby.org)

> **[Sophrinix - Overview](https://github.com/Sophrinix)**
>
> KK4HXE. Sophrinix has 535 repositories available. Follow their code on GitHub.