BitCCL Integration

[MrNaif2018]

This issue contains a list of improvements in the BitCCL area (integrating it):

• Fix security issues with imports still being allowed, for example:
  template.__globals__['os'].listdir('/')
• Start integration process with the Merchants API: extend plugins functionality or move the state from state module to state object or other way that is easier to modify
• Think of execution policies: store-wide and server-wide, to configure/limit scripts options
• Integrate into the Merchants API
• Custom scripts execution policies

Note: BitCCL might be implemented as a plugin (see #242)

[MrNaif2018]

From the further investigation, I think it is not possible to limit BitCCL execution fully, for example:

print((1).__class__.__base__.__subclasses__())

Executed in BitCCL environment, will return a list of all classes ever defined, providing access to all dangerous functions and modules because they are partially used in helper functions.

We have two approaches: either we can use RestrictedPython or we just not limit the merchants at all.

Because, re-thinking it, actually we still provide some helper functions for editing the database, so an attacker could just write the code which gets all wallets xpubs and sends it to remote server, we can't limit this as this is a valid use case for some merchants, but a privacy issue for others. That means that maybe that restriction is not necessary and possible anyway, and merchants just must validate the scripts they get from untrusted sources

[MrNaif2018]

We have decided to use RestrictedPython
Implementation PR: bitcart/bitccl#11
https://github.com/bitcartcc/bitccl/blob/master/README.md#how-does-bitccl-secure-the-users