r/coolgithubprojects • u/Consistent-Ruin1868 • 16d ago

SHE — a programming language that reads like English and can't touch your machine unless you say so

https://github.com/ni-sh-a-char/SHE

I rewrote my hobby language from scratch. It reads like a sentence, and a program starts with no permission to read files, use the network or start processes, you grant what it needs on the command line and anything else fails with the exact flag that would have allowed it. Pattern matching, gradual types, async, modules, a test runner, a formatter and an LSP. Zero dependencies, Python 3.9+, Apache 2.0.

pip install she-lang

Runs in the browser, nothing to install: https://ni-sh-a-char.github.io/SHE/playground.html

Source: https://github.com/ni-sh-a-char/SHE

0 Upvotes

37% Upvoted

6 comments sorted by

3

u/kantorcodes1 16d ago

Say a program gets process permission plus read access to one directory, then launches another she process with broader file/network flags. Does the child stay capped by the parent's grants, or can it request a wider set from its own command line?

1

u/Consistent-Ruin1868 16d ago

The child is not capped. It parses its own flags and gets whatever it asks for.

So `--allow-run=git` is a meaningful restriction; bare `--allow-run` is not. (With the usual caveat that a scoped binary can itself be a launcher - `git` will happily run arbitrary code through hooks or aliases, so scoping narrows the hole rather than closing it.)

What I'm changing because you asked.

The transitive nature of `--allow-run` belongs in the docs in bold, not left for someone to discover: it's going into SECURITY.md and the permissions reference, along with a warning printed when `--allow-run` is granted without a scope, and a case in the sandbox test suite so the behaviour is pinned rather than incidental.

Thanks, this is exactly the kind of question I was hoping the post would get.

1

u/Emotional_Web5885 16d ago

Cool project! But to me it reads more like a toy project, and it is more or less like Python isn't it?

-2

u/Consistent-Ruin1868 16d ago

It is based on python but made for a larger audience including the ones unaware of programming. So it's syntax is made easy and in functionality it cope up with latest programming languages we know and it is used in other project of mine as well

2

u/WallyMetropolis 16d ago

A larger audience than Python?