CODEWITHSUNDEEP
r
user2983931
user2983931

Reputation: 304

Stop R executing System or Shell commands

i'd like to disable commands that can execute other non R related stuff like System(), Shell() e.g.

for (year in 2010:2915){
    system("calc")
}

from running within R.

any suggestions other than locking down the user executing?

thanks

edit: to add more context, we allow the users to create R scripts in our solution which are passed to the R Engine to execute, we then process those results.

Upvotes: 2

Views: 653

Answers (1)

Florent Angly
Florent Angly

Reputation: 515

Short of editing the R source code to remove the undesirable functions, which would be tedious and probably a bit dangerous, I would override these functions:

# override system()
env <- as.environment("package:base")
unlockBinding("system", env) # bindings in the base R are write-protected
assign(
  "system",
  function(...){stop("This is a forbidden command!")},
  envir=env
)
lockBinding("system", env)

This would give the following when a user runs system():

> system()

Error in system() : this is a forbidden command

So that the changes take effect each time R is started, you could override as many functions as you want this way, adding them to .First() in your (write-protected) "Rprofile.site" file:

.First <- function(){
  # code to override system() here
  # code to override shell() here
  # ...
}

Note that this will not prevent an ill-intentioned determined user from re-implementing the forbidden functionality though.

Upvotes: 2

Related Questions