[Zope] Python script safety

[Michel Pelletier]

On Sat, 27 Jan 2001, Robin Becker wrote:

> There seems to be some attempts to avoid DOS attacks by eliminating
> excessive resource usage. Might I point out that the first script I
> tried out
>
> m=range(99)
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> m=[m,m[:],m[:],m[:],m[:],m[:],m[:]]
> return m
>
> seems to be taking an awful lot of my machine's resources

The saftey restraints in through the web code try to catch only the most
naive programmer errors (like obvious infinite loops ie "while 1:"), *not*
DOS attacks.  If you are worried about that, do not give untrusted users
the ability to write scripts or methods.  DTML and Perl are just as
susceptible to this problem.  For example, all executable code is limited
to a finite number of iterations, but this is trivial to defeat:

<dtml-in "_.range(10000)">
  <dtml-in "_.range(10000)">
    <dtml-in "_.range(10000)">
      ...

you get the idea.  Only allow trusted users to create executable content.
If you feel the restraints placed on you by through the web scripts to be
too much, use an external method.

-Michel