I'm writing a web API that takes as arguments URLS of MIDI files, imports and processes them, and spits a MIDI file back out. I'm nervous just Importing whatever URL the user gives me. How can I be sure that it's really a MIDI file? (Note: I'm being paranoid for sure, but believe it or not, malicious stuff really can come in a .mid-shaped box.)
If I try to import a URL that points to a text file with a changed file extension,
Import sees right through me:
Import["http://ethan.beihl.org/erb/wp-content/uploads/2016/11/fakemidi.mid","SoundNotes"] (*Import::noelem: The Import element "SoundNotes" is not present when importing as Text.*) (*$Failed*)
But how do I know the import is guaranteed to fail under sneakier situations? Say, if the file had proper MIDI metadata but some kind of hidden payload? (I don't know a damn thing about security, so I don't even know what this situation might look like.)
The hoped-for answer to this question would be: "
Import[foo,"SoundNotes"] will only ever return
SoundNote objects or
$Failed. There is therefore no security risk." But I am still very squeamish about using
Import on a URL of unknown origin. Is there any possibility that something could go wrong while
Import is processing the URL, and before returning its verdict? If so, what kind of pre-processing could prevent it?