Safe to execute user-defined code?

[rccarlson]

I'm looking at using this in a Unity game where users can send each other code to be executed on each others machines. I would like to use this as a sandbox for the code execution.

Are there major security considerations/known vulnerabilities aside from not using cfg.AllowClr() and setting resource constraints?

[lahma]

AllowClr is the thing that will open can of forms with security, but beware that there are loopholes for making the engine burn CPU even with constraints (and there probably will always be, it's hard to find all the places where to check if things are going sour). Node/Chrome have the same problem, it's not an easy feat to protect from.

So I'd say hostile user code can't format your drive, but it can make the app unresponsive, the worst case.

If you have global variable in engine for user's credit card, the script will see it. It's hard to send it out though as there's no APIs to do so (I/O, fetch APIs or such).

[rccarlson]

Thank you! I'm also looking into further isolation with System.AppDomain to get additional security, but this gives me a good baseline to work with.

[unruledboy]

but can hostile user write code to reference jQuery etc then it would have the ability to down malicious code / upload sensitive data?

[lahma]

Jint won't load any referenced scripts (modules) without it being configured and allowed to do so. You feed Jint the scripts that you trust.

[unruledboy]

Right, so based on what I learned so far, as long as the application won't explicitly reference/allow bad codes, the user will not be able to provide malicious code and cause damages.