I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask
server running. Then, the JavaScript would send a request like http://example.com/test/?code=this_is_safe_code
. The code would be evaluated.
I don't want outside users to be able to send code through, though. I want all requests made to be internal. Since I know the internally transmitted code will be a safe mathematical expression, I feel comfortable using eval
. However, if someone from the outside sent something like http://example.com/test/?code=__import__%28%22os%22%29.system%28%22echo%20DANGER%22%29
, then Python would run __import__("os").system("echo DANGER")
. Which is obviously not safe.
The JavaScript calls are entirely client-side, I'm not using any backend JS with things like node.js
.
What are the security methods to allow internal requests from JavaScript but not external requests? Would this need to be some kind of private certificate?