2
$\begingroup$

If one runs SocketListen on a Virtual Private Server (VPS), in principle one can set up a webpage with the Wolfram Language as a back-end. For instance, with wolfram-server and a html client, one modifies the IP addresses of both the server and the client to the public IP of the VPS and voilà, you have a webpage that sends commands to a wolfram engine installed on the VPS.

Then let's say one publishes that webpage; at that point I could read the source code of that HTML page and see the IP and port of the socket utilized by the server, so that now I could make the wolfram engine on that VPS to execute any code I want! Basically I would have full control of one's VPS.

So, how to set up a secured wolfram back-end?

I want the wolfram engine installed on my VPS to execute only the specific commands requested by the webpage, but until I have a SocketListen running on my VPS anyone could send any command to it.

One solution could be to evaluate ToExpression@#["Data"]& as a SocketListen function only if the string #["Data"] matches a given pattern, but I suspect one can write a string that satisfies any pattern and eventually insert something malicious anyway.

Thanks

$\endgroup$
  • $\begingroup$ Why does your frontend have to be able to send more or less arbitrary expressions to the server? Wouldn't it be enough to expose a small number of functions that you really need to be exposed? $\endgroup$ – C. E. Aug 11 at 13:22
  • $\begingroup$ @C.E. I'm asking precisely that. How do I expose only a set of functions? Think of an HTML slider, and a Wolfram function f that takes the slider value as argument. How do I define f to do not evaluate generic commands? $\endgroup$ – Fortsaint Aug 11 at 13:41
  • $\begingroup$ You can create a socket that listens for keywords. If you send it the keyword "foo" then it will return something. If you send it the keyword "bar" then it will return something else. If you send it the string "foo.html?x=1&y=5&z=baz" then it might return something related to "foo" using the parameters "x", "y" and "z". It doesn't matter what people try to sneak into this string because you won't evaluate it. If they put something in that makes it not match the pattern you expect, the script should simply return an error. $\endgroup$ – C. E. Aug 11 at 14:05
  • $\begingroup$ Ok but think about the HTML client. The HTML page needs to contain these keywords in order to make the server to evaluate what it's needed. So, as I mentioned in the question, one could read the HTML source and see these keywords. $\endgroup$ – Fortsaint Aug 11 at 14:20
  • $\begingroup$ Sure, but what is the problem with users using those keywords? This is true for any website. You can always look at the source code, both the HTML and the JavaScript, and see what kind of requests the frontend is making to the server. It is not considered a problem. $\endgroup$ – C. E. Aug 11 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.