Security Configuration

Security is important for users of the Web Services Package as Mathematica contains many commands for examining and deleting files and for launching arbitrary processes. Mathematica commands may be executed by the client during type conversion. If the server returns a rogue expression or number, it could get executed in Mathematica. This may occur since the Web Services Package uses ToExpression to convert data returned by a web service into a data type that is convenient for the user. For example, it converts data that is specified as an xsd:int into an integer in Mathematica using ToExpression.

While the client does not execute the Mathematica commands until after the HTTP call is made, that does not mean that mischief cannot be caused on the client machine. A rogue command can delete files on a user's machine using input such as:

    DeleteFile["/etc/passwd"]

or start a telnet daemon using input such as:

    Run["telnetd -d"]

These are just two commands that could cause mischief on a user's machine. Therefore, it is very important to limit the Mathematica commands that may be executed by default on the client. To achieve this, every piece of data that gets converted using ToExpression is checked for validity. If a symbol is not allowed, then a message is sent to the user.

Validation works by collecting all the symbols into a list and steadily reducing the list. If any symbols remain after reduction, the expression is not secure. The reduction process works with lists of symbol and context names that can either be allowed or disallowed according to the following steps:

If AllowedContexts is a list, remove symbols with contexts on this list.

If AllowedContexts is not a list, remove symbols with contexts not in DisallowedContexts.

If AllowedSymbols is a list, remove symbols found in this list.

If AllowedSymbols is not a list, remove symbols that are not in DisallowedSymbols.

If no symbols remain, the expression is secure; otherwise, it is not secure.

These tests allow users to be restrictive or flexible. Using the allowed lists is restrictive and is more secure, whereas using the disallowed lists is less restrictive with less security. It is up to each individual site to decide the appropriate balance.

When the server is started, a default security model is installed. This default security model looks like this:

In[54]:=

Out[54]=

In[55]:=

Out[55]=

In[56]:=

Out[56]=

In[57]:=

Out[57]=

This model will allow any symbol in Global` context, in addition to a number of specific symbols. This is a fairly restrictive model that provides a higher level of security.