Microsoft Script Control - Blocking scripts' access to the system? - wpf

Question

I am developing a commercial VB.net WPF application that needs user generated scripts for controlling the application to be shared between users. The best way that I have come across of accomplishing this so far without writing my own parser is using the Microsoft Script Control.
It would appear that both VBScripts and JScripts run through this control have access to wscript and as a result are too powerful to be shared between programmers and non-technical users for obvious security reasons.
I have considered trying to filter out dangerous scripts with some kind of regex parsing or something but that just seems far too risky and easy to circumvent.
So, is there some way of using this control but blocking its access to the system so that it could be used for controlling only the objects that I give it? If not, could someone recommend a better way of doing this?
I do not particularly mind what language the script would be in at this stage, although having multiple options would be nice.
EDIT: I am basing my conclusion that the control is too powerful for this on the fact that the following JScript code successfully launches notepad when called using the .AddCode and .Run methods of the control.
function test(){
var shell = new ActiveXObject("WScript.shell");
shell.run("notepad.exe", 1);
}
Thanks for all the help,
Sam.

Answer 1

If you just need to kill the ActiveXObject feature which is the entry point to the system, you can silently append some lines to the code you give to the Script Control, like this for example:
ActiveXObject = null; // add this silently
function test(){
var shell = new ActiveXObject("WScript.shell"); // this will now fail
shell.run("notepad.exe", 1);
}
Of course, if you still need to give some functions to your users, you will then need to propose some sort of an API, use the AddObject function (see How To Use the AddObject Method of the Script Control), and the user would use it like this:
ActiveXObject = null; // add this silently
function test(){
// this is a controlled method, because I have added a MyAPI named object
// using AddObject, and this object has a OpenNotepad method.
MyAPI.OpenNotepad();
}
PS: WScript is a, ActiveX Scripting host, so it's not accessible from the Script Control.
PS2: This hack does not work in every Script Control underlying languages. It works in JavaScript, but not in VBScript for example.

Answer 2

From your question, it doesn't look like you gave any consideration to any of the open-source script engines out there. I would suggest that those open-source libraries could solve your sandbox problem much more easily than the Microsoft Script Control.
The way I understand it, your requirements are:
Must be able to pass objects from your program into the scripting environment, so the script can use those objects to interact with the host app.
Must not be allowed to do unsafe things like access files, launch applications, create COM objects, etc.
Given those requirements, you have quite a few options.
The first thing that comes to mind is Jint, an open-source JavaScript interpreter written in .NET that you can embed in your app. You can pass .NET objects to the script. By default, the script can actually access any class in the .NET Framework, but the script is sandboxed by default (using .NET's built-in Code Access Security), so the script can't do anything unsafe. (For example, it could use things like StringBuilder or Regex, but it would get an exception if it tried to use FileStream.) If you want, you can disable the .NET access entirely, but even with it enabled, the default sandbox would probably suit your needs.
If for some reason Jint doesn't meet your requirements, some of the other open-source JavaScript-for-.NET engines I can think of off the top of my head are Jurassic, IronJS, and JavaScript .NET.
If it matters to you, Jint, Jurassic, and IronJS are all available through NuGet.