# Server-side sandbox for running ruby scripts

**URL:** <https://www.ruby-forum.com/t/server-side-sandbox-for-running-ruby-scripts/57955>\
**Category:** Ruby\
**Created:** [April 17, 2006, 1:48am UTC](https://www.ruby-forum.com/t/server-side-sandbox-for-running-ruby-scripts/57955 "2006-04-17T01:48:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![splattael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@splattael](https://www.ruby-forum.com/u/splattael)\
**Post date:** [April 17, 2006, 1:48am UTC](https://www.ruby-forum.com/t/server-side-sandbox-for-running-ruby-scripts/57955/1 "2006-04-17T01:48:36Z")

</div>

Hello,

I would like to accomplish the following tasks:

The user writes some ruby code into a text field inside the browser,  
clicks submit, the code travels to the server where it is evaluated and  
the result is sent back and displayed.

The only problem with this can be on the server. E.g. if someone types  
‘format c:’ into the text field, well… you know what i mean. Maybe  
dumb example, but i am quite sure some h4ck3rs out there can do better  
than this.

Basically i do not care whether this stuff is a (f)CGI, Rails or  
something else, AJAX or not, my question is simply the following: Is it  
possible to put sufficiently large barricade around the evaluation code  
on the server so that it is perfectly safe from attacks through  
malicious code?  
E.g. remove the ‘require’ keyword, I/O,… I really do not need much  
there, basically some String ops, basic maths etc. Of course i can  
specify the set of needed classes exactly (or the not needed ones,  
whichever is easier to specify).

What do you think? Will it be ever really possible to say after some  
modding that it will be 100% hackerproof?

Thanks,  
Peter

---

<div class="post-metadata">

**Author:** ![splattael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@splattael](https://www.ruby-forum.com/u/splattael)\
**Post date:** [April 17, 2006, 2:03am UTC](https://www.ruby-forum.com/t/server-side-sandbox-for-running-ruby-scripts/57955/2 "2006-04-17T02:03:53Z")

</div>

Hal F. wrote:

> Peter S. wrote:
> 
> > Hello,
> > 
> > I would like to accomplish the following tasks:
> 
> This may be easier than you think.
> 
> Are you familiar with the $SAFE variable? If not,  
> it is your best friend here…  
> Thanks, i was looking _exactly_ for this!

Cheers,  
Peter

---

<div class="post-metadata">

**Author:** ![splattael](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@splattael](https://www.ruby-forum.com/u/splattael)\
**Post date:** [April 17, 2006, 1:54am UTC](https://www.ruby-forum.com/t/server-side-sandbox-for-running-ruby-scripts/57955/3 "2006-04-17T01:54:44Z")

</div>

Peter S. wrote:

> Hello,
> 
> I would like to accomplish the following tasks:

This may be easier than you think.

Are you familiar with the $SAFE variable? If not,  
it is your best friend here…

Hal