Hello,
I'm looking to build a web service that can compile some entered code (probably C/Java) and can run some tests on it. What kind of design should I follow? What compiler can I place on my server to do the job? Recommendations? Pros? Cons?
+3
A:
Kattis uses GCC and the Sun java compiler to compile C/C++/Java. What platforms you intend to support will of course determine what compilers you can use. I think it'll be easier for you if you just go with multiple compilers instead of trying to find one that can compile every language you want to support.
One of the biggest problems will probably be to prevent the submitted code from taking over your host. Java contains built in support for limiting what classes a program can use, but I'm not sure how one would prevent things like forking and creating sockets in C/C++.
Zareth
2010-10-31 00:14:29
+1 for mentioning the security issues. One possibility would be to have a special purpose account with very few privileges that runs the code, and to run the code with severe limits set (ie: niced, with low CPU and memory caps). Even then, trying to secure something like this is like trying to waterproof a burlap sack by plugging all of the holes individually.
Laurence Gonsalves
2010-10-31 00:39:35
Yeah - a sandbox setup would be needed to restrict the actions of the user entered code.
sparkFinder
2010-10-31 00:46:33
A:
For Java, see the JavaCompiler.
I provide a little tool called the SSCCE Text Based Compiler that can do this on the client side, and as the docs. note, it requires a Java SDK, not just a JRE.
Pros:
- Server-side compilation & running of code sounds funky!
Cons:
A long time ago I also provided a tool to compile code (but not run it) on one of my domains. It turned out that particular types of code could tie the Sun compiler up in knots that would require more than 30 minutes to compile less than 100 lines of code! Denial of Service attack, anyone? Since I did not have the time to implement a solution, I withdrew the tool.
For running the code, you will almost certainly need to implement a comprehensive SecurityManager.
Andrew Thompson
2010-10-31 04:23:58
A:
The simplest thing to get going is a web container (like Tomcat or Jetty) where the users are allowed to upload their own JSP-pages.
These are automatically compiled by the web container, and executed, when requested.
Thorbjørn Ravn Andersen
2010-10-31 04:43:47