title: I need to run untrusted server-side code in a web app - what are my options?
body: <p><em># Context -- skip if you want to get right to the point</em><br>
  I've been building a rather complex web application in Python (Bottle/gevent/MongoDB). It is a RSVP system which allows several independent front-end instances with registration forms als well as back-end access with granular user permissions (those users are our clients). I now need to implement a flexible map-reduce engine to collect statistics on the registration data. A one-size-fits-all solution is impossible since the data gathered varies from instance to instance. I also want to keep this open for our more technically inclined clients.<br>
  <em># End of context</em></p>
  
  <p>So I need to execute arbitrary strings of code (some kind of ad-hoc plugin - language doesn't matter) entered through a web interface. I've already learned that it's virtually impossible to properly sandbox Python, so that's no option.</p>
  
  <p>As of now I've looked into Lua and found <a href="https://pypi.python.org/pypi/lupa" rel="nofollow">Lupa</a>, Lunatic Python and Lupy, but all three of them allow access to parts of the Python runtime.</p>
  
  <p>There's also <a href="https://pypi.python.org/pypi/PyExecJS" rel="nofollow">PyExecJS</a> and its various runtimes (V8, Node, SpiderMonkey), but I have no idea whether it poses any security risks.</p>
  
  <p><strong>Questions:</strong><br>
  1. Does anyone know of another (more fitting) option?<br>
  2. To those familiar with any of the Lua bindings: Is it possible to make them completely safe without too much hassle?<br>
  3. To those familiar with PyExecJS: How secure is it? Also, what kind of performance should I expect for, say, calling a short mapping function 1000 times and then iterating over a 1000-item list?</p>