marinebon / infographiqR

R functions for creation of interactive intelligent infographics, ie infographiq
https://marinebon.github.io/infographiqR
MIT License
11 stars 2 forks source link

[security] need to sanitize `plot_indicators.csv$plotting_function_call` #33

Open 7yl4r opened 6 years ago

7yl4r commented 6 years ago

The addition of custom plotter functions currently evals the cell contents directly or code from an arbitrary brew file (see R/get_plotting_function_brew.R).

The risk here is that running create_info_site without carefully inspecting plot_indicators.csv and any .brew templates referenced therein might lead one to execute unexpected R code. It's no worse than copy-pasting an R script from the internet in the first place, but it's worth noting that we could improve this by sanitizing the input or running it in some sort of sandbox.