In GregorDeCillia/kasper: Another Safety Providing Evaluator in R

library(badger)

kasper: another safety providing evaluator in R

r badge_lifecycle("experimental") r badge_custom("language", "R", "blue", "https://cran.r-project.org/") r badge_github_version(color = "red") r badge_code_size() r badge_travis()

This package allows to safely evaluate strings in R using something more sophisticated than

code <- "x <- 1"
eval(parse(text = code))

by applying a whitelisting logic. The "whitelist" contains safe commands which won't be able to hurt your system when the code is sent by a client. This package was developed for usage in a shiny web application that aims to give users access to an editor where they can execute R scripts on a server. In order to secure the server, this package is supposed to be used in the future.

Installation

## install from github
devtools::install_github("GregorDeCillia/kasper")

Usage

Create a new evaluator with evaluator$new(). This will initialize a new evaluator object.

library(kasper)
myEvaluator <- evaluator$new()

The evaluator object has a method eval(), which evaluates R code passed as a string or as an expression.

myEvaluator$eval({
  x <- 1; x <- x + 1; x; x - 1
})

There are no outputs? Don't worry they are all captured in the myEvaluator object and can be retrieved with replay(). The method is named after the underlying function evaluate::replay which was developed by the r-lib organization.

myEvaluator$replay()

Error handling

If your R code contains any errors, error messages will be returned by the replay() method. This does not interrupt the evaluation.

myEvaluator$eval({ y; 2 + 2 })
myEvaluator$replay()

The whitelist

An error also occurs if the user try to perform anything that is not whitelisted. Functions like system() are not available and treated as though they do not exist.

myEvaluator$eval("system('mkdir testdir')")
myEvaluator$replay()

To display all whitelisted commands, use getWhiteList().

head(myEvaluator$getWhiteList())

dplyr

The evaluator can add minimal support for dplyr operations by setting the dplyr flag to TRUE.

myEvaluator <- evaluator$new(dplyr = TRUE)
myEvaluator$eval({
  data.frame(a = 1:4, b = letters[1:4]) %>% filter(a < 3)
})
myEvaluator$replay()

Similar projects

• See https://github.com/rapporter/sandboxR for an evaluator that uses a blacklisting logic to safely evaluate R expressions.
• See https://github.com/jeroen/RAppArmor for a package that relies on AppArmor to provide protection for Linux systems.

GregorDeCillia/kasper documentation built on May 5, 2019, 11:06 p.m.