5
$\begingroup$

If one runs SocketListen on a Virtual Private Server (VPS), in principle one can set up a webpage with the Wolfram Language as a back-end. For instance, with wolfram-server and a html client, one modifies the IP addresses of both the server and the client to the public IP of the VPS and voilà, you have a webpage that sends commands to a wolfram engine installed on the VPS.

Then let's say one publishes that webpage; at that point I could read the source code of that HTML page and see the IP and port of the socket utilized by the server, so that now I could make the wolfram engine on that VPS to execute any code I want! Basically I would have full control of one's VPS.

So, how to set up a secured wolfram back-end?

I want the wolfram engine installed on my VPS to execute only the specific commands requested by the webpage, but until I have a SocketListen running on my VPS anyone could send any command to it.

One solution could be to evaluate ToExpression@#["Data"]& as a SocketListen function only if the string #["Data"] matches a given pattern, but I suspect one can write a string that satisfies any pattern and eventually insert something malicious anyway.

Thanks

Improve this question
$\endgroup$
7
  • $\begingroup$ Why does your frontend have to be able to send more or less arbitrary expressions to the server? Wouldn't it be enough to expose a small number of functions that you really need to be exposed? $\endgroup$
    – C. E. ♦
    Commented Aug 11, 2019 at 13:22
  • $\begingroup$ @C.E. I'm asking precisely that. How do I expose only a set of functions? Think of an HTML slider, and a Wolfram function f that takes the slider value as argument. How do I define f to do not evaluate generic commands? $\endgroup$
    – Fortsaint
    Commented Aug 11, 2019 at 13:41
  • $\begingroup$ You can create a socket that listens for keywords. If you send it the keyword "foo" then it will return something. If you send it the keyword "bar" then it will return something else. If you send it the string "foo.html?x=1&y=5&z=baz" then it might return something related to "foo" using the parameters "x", "y" and "z". It doesn't matter what people try to sneak into this string because you won't evaluate it. If they put something in that makes it not match the pattern you expect, the script should simply return an error. $\endgroup$
    – C. E. ♦
    Commented Aug 11, 2019 at 14:05
  • $\begingroup$ Ok but think about the HTML client. The HTML page needs to contain these keywords in order to make the server to evaluate what it's needed. So, as I mentioned in the question, one could read the HTML source and see these keywords. $\endgroup$
    – Fortsaint
    Commented Aug 11, 2019 at 14:20
  • $\begingroup$ Sure, but what is the problem with users using those keywords? This is true for any website. You can always look at the source code, both the HTML and the JavaScript, and see what kind of requests the frontend is making to the server. It is not considered a problem. $\endgroup$
    – C. E. ♦
    Commented Aug 11, 2019 at 14:28

1 Answer 1

Reset to default
3
$\begingroup$

People at Wolfram just let me know about the hidden sandbox option. So, a safer way to run the Wolfram Engine as a back-end is:

wolframscript -sandbox

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.