# Script Validation

**URL:** <https://www.ruby-forum.com/t/script-validation/193169>\
**Category:** IronRuby\
**Created:** [August 12, 2010, 12:14pm UTC](https://www.ruby-forum.com/t/script-validation/193169 "2010-08-12T12:14:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thorsten\_Hans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/9f8e36/32.png) [@Thorsten\_Hans](https://www.ruby-forum.com/u/Thorsten_Hans)\
**Post date:** [August 12, 2010, 12:14pm UTC](https://www.ruby-forum.com/t/script-validation/193169/1 "2010-08-12T12:14:33Z")

</div>

Hi,

I’m currently hosting IronRuby within a C# Application. Is there any way  
to  
validate the IronRuby scripts that will be invoked by the DLR?

For example I’d like to prevent users from executing scripts that  
include  
the “require” statement or an impersonation statement…

Any ideas?

thx

Thorsten

---

<div class="post-metadata">

**Author:** ![Thorsten\_Hans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/9f8e36/32.png) [@Thorsten\_Hans](https://www.ruby-forum.com/u/Thorsten_Hans)\
**Post date:** [August 12, 2010, 12:22pm UTC](https://www.ruby-forum.com/t/script-validation/193169/2 "2010-08-12T12:22:45Z")

</div>

Regex and filter it. I don’t think the DLR has a sandbox mechanism for  
this.

---

<div class="post-metadata">

**Author:** ![Thorsten\_Hans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/9f8e36/32.png) [@Thorsten\_Hans](https://www.ruby-forum.com/u/Thorsten_Hans)\
**Post date:** [August 12, 2010, 5:59pm UTC](https://www.ruby-forum.com/t/script-validation/193169/3 "2010-08-12T17:59:58Z")

</div>

I just recently had the same question in mind - how could one sandbox  
IronRuby?

I’d imagine that .NET’s built-in security model could be used to prevent  
the  
app from accessing the file system, P/Invoking, etc; however, I don’t  
know  
if the security model is fine grained enough to apply to just a  
particular  
AppDomain. If it it is, then you could probably use IronRuby’s built-in  
method for running scripts in another AppDomain - one that’s locked  
down.

I’m sort of ignorant in this area though, so I can’t really help that  
much.  
Hopefully someone smarter than myself will chime in.

-Charles

---

<div class="post-metadata">

**Author:** ![Thorsten\_Hans](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/9f8e36/32.png) [@Thorsten\_Hans](https://www.ruby-forum.com/u/Thorsten_Hans)\
**Post date:** [August 12, 2010, 6:05pm UTC](https://www.ruby-forum.com/t/script-validation/193169/4 "2010-08-12T18:05:15Z")

</div>

We have a sandboxing mechanism - we rely on CLR’s AppDomains:  
[http://blogs.msdn.com/b/shawnfa/archive/2005/08/08/449050.aspx](http://blogs.msdn.com/b/shawnfa/archive/2005/08/08/449050.aspx)  
You can use this API in conjunction with  
ScriptRuntime.CreateRemote(appDomain, setup) DLR Hosting API.

I wouldn’t even try to do any source code analysis to ensure security  
rules if I were you. You’d be doomed to failure. For example, consider  
this script

string my\_script = @“x, y = ‘u’, ‘b’; eval("req#{x}uire  
#{y}ad\_script")”

how do you analyze that? (Not that it would be completely impossible to  
do so in this particular case, but you get the point.)

Tomas

From: removed\_email\_address@domain.invalid  
[[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)] On Behalf Of Dody  
Gunawinata  
Sent: Thursday, August 12, 2010 3:17 AM  
To: removed\_email\_address@domain.invalid  
Subject: Re: [Ironruby-core] Script Validation

Regex and filter it. I don’t think the DLR has a sandbox mechanism for  
this.  
On Thu, Aug 12, 2010 at 12:57 PM, Thorsten Hans  
\<removed\_email\_address@domain.invalid[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)\> wrote:  
Hi,

I’m currently hosting IronRuby within a C# Application. Is there any way  
to validate the IronRuby scripts that will be invoked by the DLR?

For example I’d like to prevent users from executing scripts that  
include the “require” statement or an impersonation statement…

Any ideas?

thx

Thorsten