3
$\begingroup$

I'm writing a web API that takes as arguments URLS of MIDI files, imports and processes them, and spits a MIDI file back out. I'm nervous just Import[]ing whatever URL the user gives me. How can I be sure that it's really a MIDI file? (Note: I'm being paranoid for sure, but believe it or not, malicious stuff really can come in a .mid-shaped box.)

If I try to import a URL that points to a text file with a changed file extension, Import sees right through me:

Import["http://ethan.beihl.org/erb/wp-content/uploads/2016/11/fakemidi.mid","SoundNotes"]
(*Import::noelem: The Import element "SoundNotes" is not present when importing as Text.*)
(*$Failed*)

But how do I know the import is guaranteed to fail under sneakier situations? Say, if the file had proper MIDI metadata but some kind of hidden payload? (I don't know a damn thing about security, so I don't even know what this situation might look like.)

The hoped-for answer to this question would be: "Import[foo,"SoundNotes"] will only ever return SoundNote objects or $Failed. There is therefore no security risk." But I am still very squeamish about using Import on a URL of unknown origin. Is there any possibility that something could go wrong while Import is processing the URL, and before returning its verdict? If so, what kind of pre-processing could prevent it?

$\endgroup$
3
  • 1
    $\begingroup$ "SoundNotes" is an "element", not a "format". It's maybe better to Import[..., {"MIDI", "SoundNotes"}] because this enforces the MIDI format and won't try to process the file as e.g. text, as in your example. About security: I don't think Mathematica is strong on this. If someone targets you, they'll find a way to construct a "bad file" anyway ... $\endgroup$
    – Szabolcs
    Nov 24, 2016 at 7:57
  • 2
    $\begingroup$ An interesting question. My guess is that WRI will never be able (nor willing) to guarantee any kind of security, as the threats you mention are too diverse and will also evolve. $\endgroup$
    – Yves Klett
    Nov 24, 2016 at 10:57
  • $\begingroup$ I also suspect that to make this process robust and secure, they'd need to open up internals to outside inspection more than they'd like. $\endgroup$ Nov 26, 2016 at 4:29

0

Browse other questions tagged or ask your own question.