> is it equally obvious that the compiler also needs to be sandboxed?
I would NEVER expect that one can run a C or C++ compiler on arbitrary input safely. There are so many potential attack vectors and, unless the authors have gone out of their way extensively to prevent them, it seems very likely they would suffer from buffer overflows, leaking memory to callers, and in the worst case arbitrary code execution.
I doubt any one of these websites is safe unless using very strict validation or disposable VMs/hardware in some way.
I would NEVER expect that one can run a C or C++ compiler on arbitrary input safely. There are so many potential attack vectors and, unless the authors have gone out of their way extensively to prevent them, it seems very likely they would suffer from buffer overflows, leaking memory to callers, and in the worst case arbitrary code execution.
I doubt any one of these websites is safe unless using very strict validation or disposable VMs/hardware in some way.