-
-
Notifications
You must be signed in to change notification settings - Fork 6
Htmlwidget #36
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Htmlwidget #36
Changes from all commits
ba8d6ab
0d7a966
e845664
ed29b9c
a4afcbd
a4a69e5
8a436ee
1ef68ba
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -223,3 +223,79 @@ plot.gexf <- function( | |||||||||||||||||||||||||||||||||||||||||||||||
| do.call(servr::httd, c(list(dir = dir), httd.args)) | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
| #' @import htmlwidgets | ||||||||||||||||||||||||||||||||||||||||||||||||
| #' @export | ||||||||||||||||||||||||||||||||||||||||||||||||
| gexfjs <- function( | ||||||||||||||||||||||||||||||||||||||||||||||||
| gexf = "lib/gexf-1/lesmiserables.gexf" , # This is the onlyone that is working... for now | ||||||||||||||||||||||||||||||||||||||||||||||||
| width = NULL, | ||||||||||||||||||||||||||||||||||||||||||||||||
| height = NULL | ||||||||||||||||||||||||||||||||||||||||||||||||
| ) { | ||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||
| # Disallow URL schemes to prevent SSRF | |
| if (grepl("^[a-zA-Z]+://", gexf)) stop("URLs are not allowed for 'gexf' argument") |
Copilot
AI
Dec 1, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
readLines(gexf) will read whatever path/URL is provided and the result is placed into x$data, which is then sent to the browser via the htmlwidget. In a Shiny context, if an attacker can control gexf, they can cause the server to read arbitrary local files (e.g., /etc/passwd) and exfiltrate the contents to the client. Restrict gexf to a known safe directory (use normalizePath and a base-dir check), reject absolute/parent (..) paths, and avoid echoing raw file contents back to the client (drop x$data or send only parsed/sanitized fields). For example:
base <- system.file("gexf-graphs", package = "rgexf")
path <- normalizePath(gexf, winslash = "/", mustWork = TRUE)
stopifnot(startsWith(path, normalizePath(base, winslash = "/")))
# Prefer not to include raw file content in x$data
x <- list(path = path)| # read the gexf file | |
| data <- paste(tryCatch(readLines(gexf), error = function(e) "e"), collapse="\n") | |
| # # create a list that contains the settings | |
| # settings <- list( | |
| # drawEdges = drawEdges, | |
| # drawNodes = drawNodes | |
| # ) | |
| # pass the data and settings using 'x' | |
| x <- list( | |
| path = gexf, | |
| data = data#, | |
| # Restrict gexf to a known safe directory | |
| base <- system.file("lib/gexf-1", package = "rgexf") | |
| path <- normalizePath(gexf, winslash = "/", mustWork = TRUE) | |
| if (!startsWith(path, normalizePath(base, winslash = "/"))) { | |
| stop("gexf file must be within the package's lib/gexf-1 directory.") | |
| } | |
| # pass only the safe path using 'x' | |
| x <- list( | |
| path = path |
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
| @@ -0,0 +1,40 @@ | ||||
| HTMLWidgets.widget({ | ||||
|
|
||||
| name: "gexfjs", | ||||
|
|
||||
| type: "output", | ||||
|
|
||||
| factory: function(el, width, height) { | ||||
|
|
||||
| // create our sigma object and bind it to the element | ||||
| // The GexFJS object is created before hand. | ||||
| // var gf = new GexfJS(el.id); | ||||
|
|
||||
| return { | ||||
| renderValue: function(x) { | ||||
|
|
||||
| // parse gexf data | ||||
| var parser = new DOMParser(); | ||||
| var data = parser.parseFromString(x.data, "application/xml"); | ||||
|
||||
| var data = parser.parseFromString(x.data, "application/xml"); |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| dependencies: | ||
| - name: gexf | ||
| version: 1.0 | ||
| src: htmlwidgets/lib/gexfjs | ||
| stylesheet: | ||
| - styles/gexfjs.css | ||
| - styles/jquery-ui-1.10.3.custom.min.css | ||
| script: | ||
| - setup.js | ||
| - js/jquery-2.0.2.min.js | ||
| - js/jquery.mousewheel.min.js | ||
| - js/jquery-ui-1.10.3.custom.min.js | ||
| - js/gexfjs.js | ||
| - config.js |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <projectDescription> | ||
| <name>gexf-js</name> | ||
| <comment></comment> | ||
| <projects> | ||
| </projects> | ||
| <buildSpec> | ||
| <buildCommand> | ||
| <name>com.aptana.ide.core.unifiedBuilder</name> | ||
| <arguments> | ||
| </arguments> | ||
| </buildCommand> | ||
| </buildSpec> | ||
| <natures> | ||
| <nature>com.aptana.projects.webnature</nature> | ||
| </natures> | ||
| </projectDescription> |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /*** USE THIS FILE TO SET OPTIONS ***/ | ||
|
|
||
| GexfJS.setParams({ | ||
| graphFile : "lib/gexf-1/lesmiserables.gexf", | ||
| /* | ||
| The GEXF file to show ! -- can be overriden by adding | ||
| a hash to the document location, e.g. index.html#celegans.gexf | ||
| GEXF files can now be replaced by pre-processed JSON files (use gexf2json.py) | ||
| for faster load time | ||
| */ | ||
| showEdges : true, | ||
| /* | ||
| Default state of the "show edges" button. Set to null to disable button. | ||
| */ | ||
| useLens : false, | ||
| /* | ||
| Default state of the "use lens" button. Set to null to disable button. | ||
| */ | ||
| zoomLevel : 0, | ||
| /* | ||
| Default zoom level. At zoom = 0, the graph should fill a 800x700px zone | ||
| */ | ||
| curvedEdges : true, | ||
| /* | ||
| False for curved edges, true for straight edges | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| edgeWidthFactor : 1, | ||
| /* | ||
| Change this parameter for wider or narrower edges | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| minEdgeWidth : 1, | ||
| maxEdgeWidth : 50, | ||
| textDisplayThreshold: 9, | ||
| nodeSizeFactor : 1, | ||
| /* | ||
| Change this parameter for smaller or larger nodes | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| replaceUrls : true, | ||
| /* | ||
| Enable the replacement of Urls by Hyperlinks | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| showEdgeWeight : true, | ||
| /* | ||
| Show the weight of edges in the list | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| showEdgeLabel : true, | ||
| sortNodeAttributes: true, | ||
| /* | ||
| Alphabetically sort node attributes | ||
| */ | ||
| showId : true, | ||
| /* | ||
| Show the id of the node in the list | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| showEdgeArrow : true, | ||
| /* | ||
| Show the edge arrows when the edge is directed | ||
| this setting can't be changed from the User Interface | ||
| */ | ||
| language: false, | ||
| /* | ||
| Set to an ISO language code to switch the interface to that language. | ||
| Available languages are: | ||
| - German [de] | ||
| - English [en] | ||
| - French [fr] | ||
| - Spanish [es] | ||
| - Italian [it] | ||
| - Finnish [fi] | ||
| - Turkish [tr] | ||
| - Greek [el] | ||
| - Dutch [nl] | ||
| If set to false, the language will be that of the user's browser. | ||
| */ | ||
| }); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Typo in comment: "onlyone" should be "only one" (two words).