parameter for http only

Q&A's, tips, howto's
Locked
protozen
Posts: 36
Joined: Thu Aug 22, 2013 4:02 am

parameter for http only

Post by protozen »

When using -http, should newlisp still be processing file writing requests etc.. like with (write-file "http://xzy.com/index.html" "blah"). This is happening on several newlisp versions on windows and linux. If this is intended behavior, is there a simple way to disable it?

Lutz
Posts: 5289
Joined: Thu Sep 26, 2002 4:45 pm
Location: Pasadena, California
Contact:

Re: parameter for http only

Post by Lutz »

File modifying functions are available on purpose. The 'http' mode is used to run newLISP as a web server, which needs to have read-write access to the filesystem.

But you can redefine protected function symbols using 'constant':

Code: Select all

> (constant 'write-file (fn () (throw-error "function not allowed")))
(lambda () (throw-error "function not allowed"))

> (write-file x y)

ERR: user error : function not allowed
called from user function (write-file x y)
> 

protozen
Posts: 36
Joined: Thu Aug 22, 2013 4:02 am

Re: parameter for http only

Post by protozen »

Thank you.

protozen
Posts: 36
Joined: Thu Aug 22, 2013 4:02 am

Re: parameter for http only

Post by protozen »

Actually that doesn't work, but it's a good way to redefine methods to implement a form of permissions. What I mean is that when you run newlisp as a process with -http as in;

newlisp -http -d 8080 src.lsp

and in other newlisp process (write-file "http://localhost:8080/blah.txt" "write test") ... you'll find blah.txt with "write test" contents in the cwd of "newlisp -http -d 8080 src.lsp" .

I know we're not really suppose to use it as production, but for simple sites, I would like to use the embedded server, but the above issues allows people to use file functions to overwrite pages etc... Files can be made write protected, but this is a small band-aid and doesn't really solve other issues. Is there a way to prevent the remote file processing?

I also see external actors trying to use it as an http proxy, as this is how it shows up in nmap. I've not looked into the implementation or security issues, just looking for quick and simple site publishing.

ralph.ronnquist
Posts: 228
Joined: Mon Jun 02, 2014 1:40 am
Location: Melbourne, Australia

Re: parameter for http only

Post by ralph.ronnquist »

You might want to check out thttpd,

Lutz
Posts: 5289
Joined: Thu Sep 26, 2002 4:45 pm
Location: Pasadena, California
Contact:

Re: parameter for http only

Post by Lutz »

In newLISP version 10.7.4 a new server mode using the -http-safe flag on server start will suppress HTTP PUT and DELETE requests. This will cause 'write-file and delete-file with url', 'put-url' and 'delete-url' functions issued from a newLISP client to return the text message "Server in safe mode".

http://www.newlisp.org/downloads/develo ... nprogress/

Ps: files can still be uploaded via a POST request, but require a server side script.

protozen
Posts: 36
Joined: Thu Aug 22, 2013 4:02 am

Re: parameter for http only

Post by protozen »

Ah great thanks Lutz!

Locked