🔒 Locked

Python script within Python

Started by ObsidianBlk Jun 3, 2010 at 8:38 PM 5 replies 2k views

Original Post

Jun 3, 2010 at 8:38 PM

Hi all!

This may be strange, but I've got a conundrum...
I'm working on a GUI system to be used in an game I'm developing. I'm using a MVC design scheme for it, and, for all intents and purposes, it's working very well, however, one key issue is in "themeing" the widgets. I want to allow for users of the GUI to theme not just the colors, but how individual widgets are rendered.

Basically, I want to give the users access to a subset of python so if a user were to take my game (or, if a developer used the GUI library itself) they can use this python subset to write a script defining how a widget is to be rendered.
(And by "Widget" I mean base elements such as FRAME, BUTTON, SLIDER, etc etc)

To this end, I've been doing some research on Python's eval function. On the surface, it looks like exactly what I need down to the ability to choose what objects are available for the evaluated render code. My fear is it looks too good. Not to mention the general consensus of "NO! EVAL IS TOTALLY AND ABSOLUTELY UNSAFE".

Is Eval what I need or is there a better way of using Python as a scripting language within a python app?

Tntricker

Jun 3, 2010 at 8:49 PM

In my limited experience with python, it doesn't seem to make a good scripting language when your talking about sand-boxing. There's been many heated discussions on several projects about this.. and I really don't have an answer for you other then at the moment there is no way to completely lock python down (except maybe a bastardized embedded interpreter).

However if you don't need heavy security... go ahead and use it.

SiCrane

Jun 3, 2010 at 8:50 PM

Right now, the safest way I know of to run a python script is the RestrictedPython module from Zope.

ObsidianBlk

Jun 3, 2010 at 9:34 PM

Quote:
Original post by SiCrane
Right now, the safest way I know of to run a python script is the RestrictedPython module from Zope.

This looks promising, but I can't seem to identify which version of python RestrictedPython is using. Does it work in Python 2.6 or is it for the 3.x versions?

Probably should have mentioned I'm working with Python 2.6. If possible, I'm also doing my best to limit the number of modules required that don't come with the standard python library. If it turns out RestrictedPython is the best way to go, I'll definitely add it, but I'd rather not.

swiftcoder

Jun 3, 2010 at 10:26 PM

Another approach I have seen is to embed a tinypy interpreter in a python module, and use that to execute untrusted scripts. It isn't a panacea, as tinypy has some small differences to standard python, and lacks support for many extension modules, but as a sandboxed interpreter for small scripts, it gets the job done.

ObsidianBlk

Jun 4, 2010 at 8:12 AM

Quote:
Original post by swiftcoder
Another approach I have seen is to embed a tinypy interpreter in a python module, and use that to execute untrusted scripts. It isn't a panacea, as tinypy has some small differences to standard python, and lacks support for many extension modules, but as a sandboxed interpreter for small scripts, it gets the job done.

Actually, after my initial post, I started looking up that approach (a mini-interpreter) and I'm thinking that might be the best way to go.

Thank you!

wodinoneeye

Jun 9, 2010 at 1:42 AM

Im trying to remember how I did something like this at work for a automated testing rig.

You can build a regular python 'script' file to execute (in a fixed file name) and then do the equivalent of #include (import) on-the-fly where you then execute that files routines (same interface names) which then will run the included code.

I did this because I needed to pull different tests from a SVN server and imbed them into the standard testrig and then execute them (on a remote machine).
It actually was a whole directory folder for each test so that assets specific to that test could be used.

I just dont recall if I started a seperate process to execute the file (possibly so it wouldnt cache that one compiled test and try to reuse it when the next test ran.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.