Need better sanitization of inputs

[amellnik]

Sending a system of equations like

dx = a*x - b*x*y + println("meh")
dy = -c*y + d*x*y

does print 'meh' on the server before throwing any errors at the moment...

[ChrisRackauckas]

I see. Pre-parsing should be done before ParameterizedFunctions.jl then, since one place where ParameterizedFunctions is expanding is actually to make it easier to use user-defined functions (which of course runs counter to this)

[ChrisRackauckas]

It seems like you have setup input sanitation. Are you looking to do more or is this complete?

[amellnik]

Right now the user can execute arbitrary code on the server, we're only preventing them from defining new functions (not sure that even helps at all). I think we need to look at the parsed diff eq and vars and throw an error if any function not on a whitelist is called.

[ChrisRackauckas]

Maybe this is a good list to whitelist from?

https://github.com/johnmyleswhite/Calculus.jl/blob/master/src/differentiate.jl#L116-L186

[ChrisRackauckas]

Some people on the Gitter took it for a spin... to say the least. One thing that they found is that we need to also get rid of any control flow blocks:

2017-01-16T06:23:06.655428+00:00 app[web.1]: Diff equ: begin  # none, line 2:
2017-01-16T06:23:06.655457+00:00 app[web.1]:     dx = a * x - b * x * y # none, line 3:
2017-01-16T06:23:06.728152+00:00 app[web.1]:     dy = -c * y + d * x * y + while true # none, line 3:
2017-01-16T06:23:06.728212+00:00 app[web.1]:             end
2017-01-16T06:23:06.728266+00:00 app[web.1]: end

[amellnik]

Good find, I should have some more time for this again tomorrow

…

On Sun, Jan 15, 2017 at 10:33 PM, Christopher Rackauckas < ***@***.***> wrote: Some people on the Gitter took it for a spin... to say the least. One thing that they found is that we need to also get rid of any control flow blocks: 2017-01-16T06:23:06.655428+00:00 app[web.1]: Diff equ: begin # none, line 2: 2017-01-16T06:23:06.655457+00:00 app[web.1]: dx = a * x - b * x * y # none, line 3: 2017-01-16T06:23:06.728152+00:00 app[web.1]: dy = -c * y + d * x * y + while true # none, line 3: 2017-01-16T06:23:06.728212+00:00 app[web.1]: end 2017-01-16T06:23:06.728266+00:00 app[web.1]: end — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#6 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGzU_rjkbZaLt05Mm94QurdrCjlPVBeIks5rSw9EgaJpZM4LjfvM> .

[ChrisRackauckas]

Right now the user can execute arbitrary code on the server, we're only preventing them from defining new functions (not sure that even helps at all).

that is not taking into account one line func deffinitions, I guess you are looking for the functionkeyword

@Ismael-VC

[Ismael-VC]

that is not taking into account one line func definitions

Please see: #7.

[ChrisRackauckas]

Looks good. We should now probably expand the parsing to every Julia keyword for any kind of block. Is there a list somewhere?

[ChrisRackauckas]

I think we're good on this. At least, everything I tried doesn't work anymore. Of course, there may be something I missed which we can deal with as its own case.

[amellnik]

I think it looks good for the main expression. I'm going to move things around a bit to make sure that vars and similar also get the same sanitation.