I am going to make an online judge platform.

I have looked for some online judge platforms on the Internet for reference (I mean the platforms which have the source code available, and can be hosted my others, not something like Codeforces). Most of them have a web interface written in PHP (or something else).

When users submit the solutions of the problems, the submissions are sent to another programs (a server side program written in C++, Java or something else), which is hosted on or not on the same server, through socket.

What is the benefit of this design? Why not doing so through PHP, with functions like exec()? Which design will you appreciate more?

  • this post is rather hard to read (wall of text). Would you mind editing it into a better shape?
    – gnat
    Jun 21 '13 at 9:26
  • @gnat Sorry for my bad writing skill, but I don't know how to make it better.
    – qpalz
    Jun 21 '13 at 11:44

It can be done for security and to detect or prevent cheating. It's called sandboxing.

Your main server likely has a lot of important things on it: your source code, your database, access to email functions, etc. To exec arbitrary code from an untrusted user on that server is asking for trouble. Even if you sanitized their code (which is a big if, because you can't determine exactly how a program will behave without running it), there may be a PHP bug that they can exploit to take control of the server.

From there they could do anything from downloading the problem answers up to stealing credit card information (if you collect payments), wiping your database, or sending out spam.

If you sandbox and run submissions on another server, you can restrict that server's permissions by turning off modules like curl, mysql, and sendmail. You can limit it to the more basic functions that your users will need for solving coding problems.

  • Thanks for your detailed answer. To conclude, using this design is for security reasons.
    – qpalz
    Jun 22 '13 at 11:14
  • But why don't you use chroot to run the users' code? chroot can also work as a sandbox!
    – qpalz
    Jun 22 '13 at 11:17
  • According to Wikipedia, only the root user can run chroot. Your webserver shouldn't be running as root. Wikipedia also mentions that "For a chrooted program to successfully start, the chroot directory must be populated with a minimum set of [configuration files, scratch space, libraries, etc.]. This can make chroot difficult to use as a general sandboxing mechanism." Jun 24 '13 at 0:13
  • There is fakechroot and fakeroot. We can use them with this command fakechroot fakeroot chroot '<dir>' without root permission. But users may break it (for both fakechroot and chroot). It is actually good that library have to be provided separately so that I can control what can be run.
    – qpalz
    Jun 24 '13 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.