Just curious, and I haven't googled because I already know it's not going to answer the question ....
So say hypothetically I launch an API to run in-line C code from the terminal. It'd just be a basic shell script that has a skeleton of a .c file and injects STDIN straight into the main function. The only header would be <stdio.h>
Is it possible to do this securely? Or is the simply allowing arbitrary C even with these restrictions a recipe for pwnage.
So it'd be just
In the endpoint directory:
index.php
run.sh
index.php would receive the string and call shell to remove comments
:a;s@//.*@@;ta; :a;s@/\*@@;ta; :a;s@\*/@@;ta;
then it would just echo out
#include <stdio.h>
int main(void) {
**
<<user input>>
**
return 0; }
into a temporary.c , compile, and then php can capture the output into a variable and with that reply to the API call.
I'm gonna do this anyway on a throwaway server but I was wondering mostly out of curiosity whether even this can be exploited. (i.e. somehow adding more headers and executing a fork bomb or something)
Jump in the discussion.
No email address required.
I don't think it matters that much that it's C vs anything else. As for whether it can be secure - sure, there are plenty of examples (you can use C on leetcode for example).
I'd probably start by looking into isolation from the rest of the system. Maybe each API call runs in a container with some limited resources and a fixed time limit?
Jump in the discussion.
No email address required.
More options
Context