Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deprecate and remove view_types from the course definition #60

Open
jaguarfi opened this issue Apr 9, 2020 · 2 comments
Open

Deprecate and remove view_types from the course definition #60

jaguarfi opened this issue Apr 9, 2020 · 2 comments
Labels
area: security Issue related to security priority: low status: blocked by Issue can't progress until other linked issues are fixed type: feature New feature or change to a feature

Comments

@jaguarfi
Copy link
Contributor

jaguarfi commented Apr 9, 2020

Migrated from Trello

Defining relative imports like view_type: .exercises.custom should not be allowed as it's A potential security issue (running unaudited code).

Basically, grader shouldn't run any code from course repository without sandbox.

@jaguarfi jaguarfi added priority: high Important issue area: security Issue related to security labels Apr 9, 2020
@markkuriekkinen markkuriekkinen added priority: low status: blocked by Issue can't progress until other linked issues are fixed type: feature New feature or change to a feature and removed priority: high Important issue labels Apr 9, 2020
@markkuriekkinen
Copy link
Contributor

markkuriekkinen commented Apr 9, 2020

Blocked by: some courses depend on custom view types and there is no solution for running view type code in a sandbox.

This issue has low priority since we trust that no teacher tries to abuse the system with custom view types.

@raphendyr
Copy link
Contributor

This issue has low priority since we trust that no teacher tries to abuse the system with custom view types.

This is true, however it also introduces blocker for wide spread use. For now, I would presume this will get fixed with a next generation of the grader.

To help with the issue, one can create a dedicated instance of the MOOC-Grader for a trust group, thus limiting the potential problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: security Issue related to security priority: low status: blocked by Issue can't progress until other linked issues are fixed type: feature New feature or change to a feature
Projects
None yet
Development

No branches or pull requests

3 participants