From michael.weylandt at gmail.com  Wed Dec 19 12:28:01 2012
From: michael.weylandt at gmail.com (Michael Weylandt)
Date: Wed, 19 Dec 2012 11:28:01 +0000
Subject: [Rd] Scanning a R script for potentially insidious commands
In-Reply-To: <50D06614.9060404@epiconcept.fr>
References: <50D06614.9060404@epiconcept.fr>
Message-ID: <C388E3C2-611A-4717-8049-D72867AB8BCB@gmail.com>



On Dec 18, 2012, at 12:48 PM, Etienne S?vin <e.sevin at epiconcept.fr> wrote:

> Hey all,
> 
> We are building a R connector for our web application.
> The user can upload a script so it can be executed on the server.
> 
> Is there a way to scan the script for insidious commands (writing on the
> disk for example) and purge them out?

Completely, not that I know of: but grepping for system() and eval() should catch a majority of red flags. 

Michael

> I guess a simple search is not enough so is there a way to analyse the
> pseudo code?
> 
> Best,
> 
> Etienne
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel



[Rd] Scanning a R script for potentially insidious commands
Michael Weylandt