Limits and safety

Fubby catches runaway programs and common mistakes with clear errors. It doesn't protect your computer from a hostile program, so please read this before running code you didn't write.

Don't run programs you don't trust. Fubby isn't an operating-system sandbox. A Fubby program can read and write your files unless you restrict it, and these limits are designed to catch mistakes rather than attacks. Fubby hasn't had an independent security audit.

Limits you can change

Set these as environment variables when you start a program. Values outside the allowed range are limited to it, except the Bela settings, which report an error.

FUBBY_MAX_STEPS=500000 FUBBY_TIMEOUT_MS=5000 fubby run app.fab

Variable	Default	Maximum	What it limits
`FUBBY_MAX_STEPS`	2,000,000	100,000,000	Interpreter steps in one run
`FUBBY_TIMEOUT_MS`	10,000	600,000	Run time in milliseconds
`FUBBY_MAX_ALLOC_BYTES`	32 MiB	256 MiB	Approximate memory charged to one run
`FUBBY_MAX_ACTIVE_ALLOC_BYTES`	128 MiB	1 GiB	Approximate memory across the whole process
`FUBBY_BELA_WORKERS`	4	8	Bela workers
`FUBBY_BELA_QUEUE`	16	64	Bela tasks waiting for a worker
`FUBBY_BELA_TASK_MS`	1,000	30,000	Run time for one Bela task

Controlling access

Variable	If not set	What it does
`FUBBY_NET_ALLOWLIST`	All HTTP is denied	A comma-separated list of hosts that Moon can reach
`FUBBY_FS_ROOT`	Files are unrestricted	The only folder that file functions, SQLite and Snow's static files can use
`FUBBY_LOCAL_REGISTRY`	None	The default local package registry folder

FUBBY_FS_ROOT helps prevent accidents, but it isn't a secure sandbox, and it shouldn't be trusted against symbolic-link or timing attacks.

Fixed limits

Area	Limit	Value
Source	One source file	1 MiB
Source	All files in one program	8 MiB
Source	Imported files	128
Source	Nesting of code	500 levels
Source	Operators in one expression chain	10,000
Running	Depth of function calls	1,000
Values	Items in one collection	100,000
Values	Nesting of lists, maps and objects	512 levels
Values	One string	16 MiB
Values	Text printed for one value before it's shortened	1 MiB
Library	JSON size and nesting	1 MiB, 128 levels
Library	Regular expression text and pattern	16 KiB, 1 KiB
Library	`str_repeat` result	1 MiB
Snow	Routes	256
Snow	Before and after middleware	32 each
Snow	Static folders	16
Snow	Query keys	128
Bela	Tasks and channels in one run	128, 16
Bela	One message or result	64 KiB
Bela	Messages and results waiting	8 MiB
Threads	Bela and Snow workers in one process	32

Moon's HTTP and SQLite limits are on the web and data page, and Snow's server options are listed there too.

What Fubby catches for you

Integer overflow and division by zero stop with an error, and never give a wrong answer silently.
Infinite loops and runaway recursion end with a clear error.
A list that contains itself prints as [1, [...]], and comparing such lists finishes.
Deeply nested code or data gives an error, and doesn't crash the interpreter.
Types are enforced while running as well as by the checker, and a plain type can't become null.
SQL parameters keep values separate from your SQL, and snow.template escapes values for HTML.

What Fubby doesn't protect against

Hostile programs. There's no process isolation, and limits are checked cooperatively, so a slow operating-system call can't be interrupted.
Memory exhaustion. Memory limits are approximate accounting, and there's no hard operating-system quota. A list containing itself stays in memory until the program ends.
Attacks on a Snow server. It has no HTTPS, login, sessions, CSRF protection or rate limiting.
Weak random numbers. random_int isn't cryptographically secure, so never use it for passwords or tokens. Fubby has no password hashing yet.
Untrusted packages. Package code runs with your program's full access.
Forged downloads. Binaries aren't signed or notarized, and checksums don't prove who published a file.

Reporting a problem

Report bugs through the public issue tracker. Please don't post passwords, private code, personal information, or details of how to exploit a security problem there.