secure way to execute php from saas application
secure way to execute php from saas application
I have developed an online "Workflow" application in SaaS, currently allowing the users to execute commands and chain them (database/sql requests, file operations, ftp i/o, etc...).
And i may now need to allow the users to execute custom php scripts (with a specific allowed php commands list) with limited privileges in the server
(hosting several customers, each customer having his own mysql database and folder for uploaded files)
A use case is the creation of a ETL (Extract-Transform-Load) task :
the workflow :
This case use needs the customer be able to edit online a custom php script
On stackoverflow i saw answers suggesting to use LXC containers, i would like to avoid this.
I was thinking to propose a textarea to the users, where for instance they would type PHP templating code (like twig for symfony) ?
Like this, the set of commands is secured, and i can choose exactly the allowed PHP commands...
Is it a good idea ?
Is there a better way to do this ?
Thanks for your help !
Why avoid containers? By doing so your now need to implement a whole range of protections.. For each of them features. What are you attempting to protect? Using containers you could give them root, and limit io, network, processes, cpu, disk, mem and all that jazz..
– Lawrence Cherone
Jul 2 at 20:24
A use case is the creation of a ETL (Extract-Transform-Load) task : the workflow 1) download a csv file to an external FTP , 2) a php script workflow on the csv for updating him (change his format, add/remove columns for instance), and 3) then import this with a mysqlimport workflow command... so the customer needs to edit online a custom php script...i put this use case in my question...
– Pierre
Jul 2 at 20:26
Cant you parse the csv, and build a UI which defines an entity which get applied when processed?
– Lawrence Cherone
Jul 2 at 20:29
Why trying to avoid containers ? I am thinking interesting to give the non-very-technical users (my current customer's profile -they are mainly non-developers, only project managers) a easy limited language (for loops, if commands) in an online editor, so in the case if i execute the php template, then no need of containers...my problematic is more to give a "for dummies" programming interface (and obviously in a secure way)
– Pierre
Jul 2 at 20:34
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Before people jump on the 'No' and 'Dear god no' band wagon, can you explain your use case? What type of content will users be inputting? Is this for showing basic data like a small biography for a form? Is it for implementing full cms controlled pages?
– Neil Masters
Jul 2 at 20:22