[Question] How to only allow a hosted CS-Script to access a few, predefined namespace/referances?

[elijah-potter]

For security purposes, I don't want to allow the script to access sensitive actions, like P/Invoke or writing files. Is there a way to do this? CSScript.RoslynEvaluator.Reset(false) does not seem to do this.

[oleg-shilo]

Basically you want to control what API is allowed to be invoked. It is a typical sandboxing use-case

CSScript.RoslynEvaluator.Reset(false) cannot help with that. It is designed to clear already referenced assemblies and prepare the evaluator for the next script execution

Sanboxing is always provided by the underlying runtime environment. In case of CS-Script it is CLR. Which is the runtime of .NET Core.

CLR does offer sandboxing API, which is called CAS. CS-Script (for .net framework) comes with the sample of how to use it.

However I am not sure if and to what extend .NET Core implements sandboxing.

The bottom line is:
If .NET Core supports sandboxing then you can use it from CS-Script scripts. But if it does not then...you know the answer :(

[elijah-potter]

Is there a way to see the assemblies a script actually does use, to reject insecure scripts?

[oleg-shilo]

Yeah, absolutely.

In fact script developer can only provide a script but it is a script host who is actually referencing assemblies. Thus you have full control over that.

I am not sure how your host app is referencing assemblies but it will be one of those:

var script = CSScript.Evaluator
                             .ReferenceAssembliesFromCode(code)
                             .ReferenceAssembly(Assembly.GetExecutingAssembly())
                             .ReferenceAssembly(Assembly.GetExecutingAssembly().Location)
                             .ReferenceAssemblyByName("System")
                             .ReferenceAssemblyByNamespace("System.Xml")
                             .TryReferenceAssemblyByNamespace("Fake.Namespace", out var resolved)
                             .ReferenceAssemblyOf(new Samples())
                             .ReferenceAssemblyOf<XDocument>()
                             .ReferenceDomainAssemblies()
                             .LoadCode<ICalc>(code);

        int result = script.Sum(13, 2);

So you can decide at runtime if you want to call any of ReferenceAssembly*.

Your script writer can still load assemblies dynamically via reflection. But you can monitor and control it by subscribing to the AppDomain LoadAssembly event. Not sure the naming is accurate.

[elijah-potter]

I am not quite sure I understand. I run
CSScript.RoslynEvaluator.DisableReferencingFromCode = true;
But the script can still do
System.IO.File.Create("234234");
I do not want the script to be able to run that.

[oleg-shilo]

But why are you expecting you should not be able to invoke System.IO.File.Create.

You have disabled DisableReferencingFromCode great. But why do you expect it to have any effect on System.IO.File.Create?