Assess security risk of Spider scripts.

[wmoore]

Might be dangerous to allow users to upload and run arbitrary Spider Procedure files on the server.

Users can run any of the Spider commands listed ​http://www.wadsworth.org/spider_doc/spider/docs/operations_doc.html

Most of these process an image (or text) and may create files.

At most risk is the delete command: ​http://www.wadsworth.org/spider_doc/spider/docs/man/de.html

This will delete a file named as specified, with the extension used in the script (E.g. "dat"). Security would be improved by enforcing the "dat" extension. r6658.

Seems that it is possible to delete files in a parent directory to the one that the script is run in, or any file in the file system that has the correct file extension.

 wjm:~ will$ cd Documents/dev/SPIDER/test
wjm:test will$ spider dat

 \__`O O'__/        SPIDER  --  COPYRIGHT
 ,__xXXXx___        HEALTH RESEARCH INC., ALBANY, NY.
  __xXXXx__
 /  /xxx\  \        VERSION:  UNIX  18.03 ISSUED: 08/31/2009
   /     \          DATE:     15-APR-2010    AT  16:00:41




*** FILE NOT FOUND: Applications/spiderweb/spider/bin/Nextresults                                  

 Results file: results.dat.000                                                                 
 Running: spider                                                                                                                                                          
 .OPERATION: DE
 DE
 .DELETE FILE: ../tmp001
  ../tmp001 
  DELETED: ../tmp001.dat
  
 .OPERATION: DE
 DE
 .DELETE FILE: /Users/will/Desktop/win001
  /Users/will/Desktop/win001 
  DELETED: /Users/will/Desktop/win001.dat
  
 .OPERATION: DE
 DE
 .DELETE FILE: /Users/will/Desktop/Picture36
  /Users/will/Desktop/Picture36 
  NO SUCH FILE: /Users/will/Desktop/Picture36.dat
  
 .OPERATION: DE  
 DE
 .DELETE FILE: /Users/will/Desktop/Picture36.png
  /Users/will/Desktop/Picture36 
  NO SUCH FILE: /Users/will/Desktop/Picture36.dat
  
 .OPERATION: 

So, this is definitely a security risk. The Spider scripts themselves should probably be vetted by admin. Add warning to script itself r6659.

[wmoore]

r6658 removes file extension from Spider script parameters.