enforce some restrictions on python

src/compute.geometry/Program.cs

@@ -219,6 +219,44 @@ static class Python
                 py.SetVariable(kv.Key, kv.Value);
             if (!script.Equals(_previousScript))
             {
+                // Don't allow certain words in the script to attempt to avoid
+                // malicious attacks
+                string[] badwords = {"exec", "Assembly", "GetType", "Activator", "GetMethod", "GetPropert" };
+                foreach(var word in badwords )
+                {
+                    if (script.IndexOf(word)>=0)
+                        throw new Exception($"Script is not allowed to contain the word {word}");
+                }
+
+                // validate that only Rhino namespaces are imported
+                const string import = "import ";
+                int importIndex = script.IndexOf(import);
+                while (importIndex >= 0)
+                {
+                    importIndex += import.Length;
+                    while (importIndex < script.Length)
+                    {
+                        char c = script[importIndex];
+                        if (c == ' ')
+                        {
+                            importIndex++;
+                            continue;
+                        }
+                        break;
+                    }
+                    if (script.IndexOf("Rhino", importIndex) != importIndex && script.IndexOf("rhinoscript", importIndex) != importIndex)
+                        throw new Exception("Attempt to import module that is not permitted");
+
+                    int commaAndContinuationIndex = script.IndexOfAny(new char[] { ',', '\\' }, importIndex);
+                    if (commaAndContinuationIndex > 0)
+                    {
+                        int newlineIndex = script.IndexOf('\n', importIndex);
+                        if (commaAndContinuationIndex < newlineIndex)
+                            throw new Exception("Do not import multiple packages with a single import statement");
+                    }
+
+                    importIndex = script.IndexOf(import, importIndex);
+                }
                 _previousCompile = py.Compile(script);
                 _previousScript = script;
             }