Download the PHP package psx/sandbox without Composer
On this page you can find all versions of the php package psx/sandbox. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package sandbox
Short Description PHP sandbox to execute a safe subset of the PHP programming language
License Apache-2.0
Homepage https://phpsx.org
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package sandbox
Sandbox
About
This library helps to execute PHP code which was provided by a user. I.e. if your app wants to provide a scripting feature where the user can provide custom PHP code. This library helps to parse this untrusted code and execute it only if there are safe calls.
Internally the library uses the PHPParser
library to parse the code. To make the code safe the sandbox allows only a small
subset of PHP. It is not possible to define a class, interface or trait. Also
all functions which produce output i.e. echo, print, etc. are not allowed. The
only way a user can return a value is by using the return statement in the
script. Every function and new call gets checked by the security manager. The
security manager contains a whitelist of all allowed functions and classes.
Its important to note that the security check is not performed on runtime,
instead we simply prevent to generate PHP code which contains untrusted code.
Because of this features like i.e. dynamic functions names
$func = 'foo'; $func(); are also not allowed.
If the code is clean the runtime generates normal PHP code and writes this to a file. All subsequent calls simply include and execute this code, thus the sandbox has almost no performance loss.
Security
It is not recommended to run PHP code from anonymous users on the internet. This feature is intended to be used i.e. by customers of a SAAS solution which need to customize specific parts of the app. If you have found a way to breakout of the sandbox please open an issue or if you like you can also create a pull request with a fitting test case. Please take a look at the tests folder to see already covered cases.
Usage
Advanced configuration
Configurations are set by passing an instance of \PSX\Sandbox\SecurityManagerConfiguration
- preventGlobalNameSpacePollution (bool): This will prevent creating functions and constants in the global name space.
- allowedNamespace (null|string): Restricts any namespaced code to be the same or a sub-namespace of the value.
Requirements
- PHP 8.0+
Installation
Install with composer composer require psx/sandbox
