Need better sanitization of inputs about diffeqonlineserver HOT 11 CLOSED

I see. Pre-parsing should be done before ParameterizedFunctions.jl then, since one place where ParameterizedFunctions is expanding is actually to make it easier to use user-defined functions (which of course runs counter to this)

from diffeqonlineserver.

It seems like you have setup input sanitation. Are you looking to do more or is this complete?

from diffeqonlineserver.

Right now the user can execute arbitrary code on the server, we're only preventing them from defining new functions (not sure that even helps at all). I think we need to look at the parsed diff eq and vars and throw an error if any function not on a whitelist is called.

from diffeqonlineserver.

Maybe this is a good list to whitelist from?

https://github.com/johnmyleswhite/Calculus.jl/blob/master/src/differentiate.jl#L116-L186

from diffeqonlineserver.

Some people on the Gitter took it for a spin... to say the least. One thing that they found is that we need to also get rid of any control flow blocks:

2017-01-16T06:23:06.655428+00:00 app[web.1]: Diff equ: begin  # none, line 2:
2017-01-16T06:23:06.655457+00:00 app[web.1]:     dx = a * x - b * x * y # none, line 3:
2017-01-16T06:23:06.728152+00:00 app[web.1]:     dy = -c * y + d * x * y + while true # none, line 3:
2017-01-16T06:23:06.728212+00:00 app[web.1]:             end
2017-01-16T06:23:06.728266+00:00 app[web.1]: end

from diffeqonlineserver.

from diffeqonlineserver.

Right now the user can execute arbitrary code on the server, we're only preventing them from defining new functions (not sure that even helps at all).

that is not taking into account one line func deffinitions, I guess you are looking for the functionkeyword

@Ismael-VC

from diffeqonlineserver.

that is not taking into account one line func definitions

Please see: #7.

from diffeqonlineserver.

Looks good. We should now probably expand the parsing to every Julia keyword for any kind of block. Is there a list somewhere?

from diffeqonlineserver.

I think we're good on this. At least, everything I tried doesn't work anymore. Of course, there may be something I missed which we can deal with as its own case.

from diffeqonlineserver.

I think it looks good for the main expression. I'm going to move things around a bit to make sure that vars and similar also get the same sanitation.

from diffeqonlineserver.