3
$\begingroup$

I'm writing a web API that takes as arguments URLS of MIDI files, imports and processes them, and spits a MIDI file back out. I'm nervous just Import[]ing whatever URL the user gives me. How can I be sure that it's really a MIDI file? (Note: I'm being paranoid for sure, but believe it or not, malicious stuff really can come in a .mid-shaped box.)

If I try to import a URL that points to a text file with a changed file extension, Import sees right through me:

Import["http://ethan.beihl.org/erb/wp-content/uploads/2016/11/fakemidi.mid","SoundNotes"]
(*Import::noelem: The Import element "SoundNotes" is not present when importing as Text.*)
(*$Failed*)

But how do I know the import is guaranteed to fail under sneakier situations? Say, if the file had proper MIDI metadata but some kind of hidden payload? (I don't know a damn thing about security, so I don't even know what this situation might look like.)

The hoped-for answer to this question would be: "Import[foo,"SoundNotes"] will only ever return SoundNote objects or $Failed. There is therefore no security risk." But I am still very squeamish about using Import on a URL of unknown origin. Is there any possibility that something could go wrong while Import is processing the URL, and before returning its verdict? If so, what kind of pre-processing could prevent it?

$\endgroup$

closed as off-topic by MarcoB, Henrik Schumacher, Coolwater, m_goldberg, halirutan May 30 '18 at 7:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "The question is out of scope for this site. The answer to this question requires either advice from Wolfram support or the services of a professional consultant." – MarcoB, Henrik Schumacher, Coolwater, m_goldberg, halirutan
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    $\begingroup$ "SoundNotes" is an "element", not a "format". It's maybe better to Import[..., {"MIDI", "SoundNotes"}] because this enforces the MIDI format and won't try to process the file as e.g. text, as in your example. About security: I don't think Mathematica is strong on this. If someone targets you, they'll find a way to construct a "bad file" anyway ... $\endgroup$ – Szabolcs Nov 24 '16 at 7:57
  • 2
    $\begingroup$ An interesting question. My guess is that WRI will never be able (nor willing) to guarantee any kind of security, as the threats you mention are too diverse and will also evolve. $\endgroup$ – Yves Klett Nov 24 '16 at 10:57
  • $\begingroup$ I also suspect that to make this process robust and secure, they'd need to open up internals to outside inspection more than they'd like. $\endgroup$ – hYPotenuser Nov 26 '16 at 4:29

Browse other questions tagged or ask your own question.