We have recently added scripting functionality to our product using Alternet with Iron Python. Within the script editor the user is able to access the System module and .NET CLR functions.
Is there a way to restrict what is available to the user in the script editor? Specifically we would want to at least remove access to anything within the System namespace.
If you’d like to limit IronPython parser code completion to not show types from the system namespaces, you just need to remove these namespaces from CodeEnvironment.Imports.
Please modify PythonParser quick start project in Alternet.Studio.AllDemos.IronPython solution like this:
var imports = new List<string>();
//imports.Add("System");
//imports.Add("System.Drawing");
//imports.Add("System.Windows.Forms");
codeEnvironment = new CodeEnvironment(null, paths, imports, null, Alternet.Common.TechnologyEnvironment.System);
pythonParser.CodeEnvironment = codeEnvironment;
then the code completion will not display any System types.
Please let me know if this is what you’re looking for.
I’d actually like to prevent the end user from being able to call anything from the System namespace within the IronPython parser.
We don’t import any System namespace functions into our code environment and after initialising a codeEnviroment without the Alternet.Common.TechnologyEnvironment.System param, I am still able to access CLR functions from the System namespace.
Is this by default included in the parser or can it be disabled?
Thank you for the clarification. So far, it looks like System and mscorlib are always part of the IronPython clr module, even if they’re not added explicitly via references/imports.
We will dig into it a bit further, and I will let you know about our findings.
Thanks for looking into that, that confirms our investigation into it also. Sanitising our inputs to the IronPython parser looks like the way to go for the moment.
In my tests, these modifications disable using System types in the IronPython script,
unless the user explicitly adds them into the script code like this:
clr.AddReference(“mscorlib”)
clr.AddReference(“System”)
import System
...