Security Issues
This section:
•Security concerns related to the HTTP interface
Some interface features of RaptorXML Server pose security concerns. These are described below together with their solutions.
Security concerns related to the HTTP REST interface
The HTTP REST interface, by default, allows result documents to be written to any location specified by the client (that is accessible with the HTTP protocol). It is important therefore to consider this security aspect when configuring RaptorXML Server.
If there is a concern that security might be compromised or that the interface might be misused, the server can be configured to write result documents to a dedicated output directory on the server itself. This is specified by setting the server.unrestricted-filesystem-access option of the server configuration file to false. When access is restricted in this way, the client can download result documents from the dedicated output directory with GET requests. Alternatively, an administrator can copy/upload result document files from the server to the target location.
Making Python scripts safe
When a Python script is specified in a command via HTTP to RaptorXML Server, the script will only work if it is located in the trusted directory. The script is executed from the trusted directory. Specifying a Python script from any other directory will result in an error. The trusted directory is specified in the server.script-root-dir setting of the server configuration file, and a trusted directory must be specified if you wish to use Python scripts. Make sure that all Python scripts to be used are saved in this directory.
Though all output generated by the server for HTTP job requests is written to the job output directory (which is a sub-directory of the output-root-directory), this limitation does not apply to Python scripts, which can write to any location. The server administrator must review the Python scripts in the trusted directory for potential vulnerability issues.