parameter for http only

[protozen]

When using -http, should  newlisp still be processing file writing requests etc.. like with (write-file "http://xzy.com/index.html">http://xzy.com/index.html" "blah"). This is happening on several newlisp versions on windows and linux. If this is intended behavior, is there a simple way to disable it?

[Lutz]

File modifying functions are available on purpose. The 'http' mode is used to run newLISP as a web server, which needs to have read-write access to the filesystem.



But you can redefine protected function symbols using 'constant':

Code Select Expand


> (constant 'write-file (fn () (throw-error "function not allowed")))
(lambda () (throw-error "function not allowed"))

> (write-file x y)

ERR: user error : function not allowed
called from user function (write-file x y)
>


[protozen]

Thank you.

[protozen]

Actually that doesn't work, but it's a good way to redefine methods to implement a form of permissions. What I mean is that when you run newlisp as a process with -http as in;



newlisp -http -d 8080 src.lsp



and in other newlisp process (write-file "http://localhost:8080/blah.txt">http://localhost:8080/blah.txt" "write test") ... you'll find blah.txt with "write test" contents in the cwd of "newlisp -http -d 8080 src.lsp" .



I know we're not really suppose to use it as production, but for simple sites, I would like to use the embedded server, but the above issues allows people to use file functions to overwrite pages etc... Files can be made write protected, but this is a small band-aid and doesn't really solve other issues. Is there a way to prevent the remote file processing?



I also see external actors trying to use it as an http proxy, as this is how it shows up in nmap. I've not looked into the implementation or security issues, just looking for quick and simple site publishing.

[rrq]

You might want to check out https://acme.com/software/thttpd">thttpd,

[Lutz]

In newLISP version 10.7.4 a new server mode using the -http-safe flag on server start will suppress HTTP PUT and DELETE requests. This will cause 'write-file and delete-file with url', 'put-url' and 'delete-url' functions issued from a newLISP client to return the text message "Server in safe mode".



http://www.newlisp.org/downloads/development/inprogress/">http://www.newlisp.org/downloads/develo ... nprogress/">http://www.newlisp.org/downloads/development/inprogress/



Ps: files can still be uploaded via a POST request, but require a server side script.

[protozen]

Ah great thanks Lutz!