0

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the JavaScript would send a request like http://example.com/test/?code=this_is_safe_code. The code would be evaluated.

I don't want outside users to be able to send code through, though. I want all requests made to be internal. Since I know the internally transmitted code will be a safe mathematical expression, I feel comfortable using eval. However, if someone from the outside sent something like http://example.com/test/?code=__import__%28%22os%22%29.system%28%22echo%20DANGER%22%29, then Python would run __import__("os").system("echo DANGER"). Which is obviously not safe.

The JavaScript calls are entirely client-side, I'm not using any backend JS with things like node.js.

What are the security methods to allow internal requests from JavaScript but not external requests? Would this need to be some kind of private certificate?

Improve this question
8
  • Why doesn't the python go and grab it instead?
    – d1str0
    Mar 13, 2016 at 22:09
  • 1
    What do you mean by "internal requests"? Are these requests coming from inside your company's firewall? Or do you mean requests that are only coming from your web page?
    – Neil Smithline
    Mar 13, 2016 at 22:33
  • @d1str0 Because the expression is generated by a JavaScript library. JavaScript also can't write to a file.
    – Luke Taylor
    Mar 13, 2016 at 22:50
  • @NeilSmithline What I mean is that these requests are generated by the web app, and then sent to a different location on the server. Since they're sent by JavaScript, they probably show as originating from the client.
    – Luke Taylor
    Mar 13, 2016 at 23:00
  • Please clarify where the JS is living. Is this all done on a client's machine or is this a JS web app with a JS backend?
    – d1str0
    Mar 14, 2016 at 0:07

1 Answer 1

Reset to default
2

You can't secure this. There's no way to ensure that your web app is on the other side of a connection. Even if you come up with (convoluted) methods of trying to checksum and sign your requests in the JavaScript, a user could simply use your JavaScript to sign their own requests.

You can probably secure this by changing the format of what you pass to the server from being free-form Python into something much better specified. For example, perhaps you pass an array of N numbers and N-1 operators. Your server would then validate (using a whitelist) that the numbers are numbers and the operators are in the allowed set of mathematical operators. If this passed, then you could reconstruct the Python code and execute it.

Another solution is to run the JavaScript on the server and have that data directly passed into the Python. In this case, you need to validate the input to the JavaScript in a manner similar to that described above.

Reference: OWASP Input Validation Cheat Sheet

Improve this answer
2
  • This sounds like a good approach. It might not work well for complex expressions, such as (-b+sqrt(b**2+4*a*c))/2a, but I like the approach of whitelisting elements. Thanks a lot!
    – Luke Taylor
    Mar 13, 2016 at 23:13
  • 1
    @Luke Look into polish notation for a straightforward approach to handle complex expressions. - It's not very user friendly though so you might need a front end parser.
    – Taemyr
    Mar 14, 2016 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .