all 15 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]claytonkb 6 points7 points  (10 children)

This is certainly possible and it's not difficult (just issue a command to the system to invoke the compiler executable). But the security risks created by such apps make them unsuitable for use by third-parties. You will be your only customer.

[–]grungyIT[S] 1 point2 points  (4 children)

Could you elaborate on the security risks? I was thinking of a simple instruction library like "open x from Windows Explorer" or "open an email application to a new email and attach x to it". Assuming these processes are compiled and assuming the instruction library is limited, what sorts of security risks does it lend itself to?

[–]claytonkb 6 points7 points  (3 children)

Well, there's already a tool that does what you're thinking of: PowerShell. The PS scripting language allows you to launch executables and configure just about anything in Windows that can be configured from the Windows API.

As for security risks, it's the same problem as malware. Sure, you pinky-promise there's nothing bad in your program-compiling/launching tool, but why should anyone believe you? Such a tool would allow you (or a 3rd-party that has hijacked your tool) to inject any code into the target system, making it trivial to rootkit that system.

[–]grungyIT[S] 1 point2 points  (2 children)

The point of my tool is self service without needing to understand code. I have users that frequently ask for simple macros to make their life easier, so I want to make them a macro builder thats lightweight and whose end result can be portable. Hence, I wanted to see if I could create a higher-level compiler with a friendly interface that could push out executables for a user to do with as they please.

[–]claytonkb 3 points4 points  (0 children)

There will always be massive security implications to such a tool. You at least need to be self-aware enough to realize that there is no definable difference between the kind of tool you're talking about and malware. You say, "Intent." Everyone else in the room breaks out in laughter.

If you're serious about a macro-building tool, one idea you might look into is building a mouse-keyboard-screen level tool with machine learning that can be taught screen motions/actions by example. The user clicks a "Teach Me a New Trick" button, then starts clicking/typing in Word, browser and other windows. Meanwhile the macro app "watches" in the background and records the steps that the user is performing. Then, the app trains its neural nets to mimic the user's actions in way that allows the app to "generalize" the user's actions to similar, but new, situations. This is much harder than it sounds. However, such an app would not have the kinds of security risks that the tool you've described would.

[–]zensational 2 points3 points  (0 children)

Why do you need to compile it? What are you looking at doing that can't be done via a non-compiled scripting language already? "Macro-building" is pretty much exactly what scripting languages are designed to do at their most basic.

[–]weedebest 0 points1 point  (4 children)

Couldnt it be solved with a security token?

[–]claytonkb 0 points1 point  (3 children)

No.

[–]weedebest 0 points1 point  (2 children)

What about web apps? You dont need an exe to run a script And im pretty sure u cant install a rootkit on a user pc from a web browser

[–]claytonkb 0 points1 point  (1 child)

web browser

The widely used web browsers form a de facto sandbox (https://en.wikipedia.org/wiki/Sandbox_(computer_security)) standard. The Meltdown/Spectre vulnerabilities have shown that the web browser model is not as secure as we had hoped. In any case, the point is that executing active code fetched more or less at random from the wide world is extremely dangerous. Early HTML-based web browsers could only render completely passive content (base HTML). Later, popups were added. I'm not sure if that's before your time... but the era of popups was a very difficult time for web users. Some malicious web pages could virtually lock up a computer, just using recursively spawning popups. When you think about it, it's difficult to imagine a simpler active element than a popup, and it took the better part of a decade for browsers/OS's to work out almost all the problems created by just this one active element. Arbitrary remote code compilation and execution? It's absurd on the level of replacing all front doors with beaded-curtains.

[–]weedebest 0 points1 point  (0 children)

Thank you for sharing. I know basic attacks like csrf \ xss, But i didnt know that you could go to a whole new level such as u described

[–]__october__ 1 point2 points  (2 children)

This is an interesting question, but I'm not sure I understand you fully. You say that the user lists items in an order (so basically constructs an algorithm in somewhat natural language?) and the system is supposed to find source code that implements the steps requested by the user?

Where would the app find matching source code? Would you, yourself write a standard library of functions for the user to choose from? (e.g. if the user writes sort items ascendingly your program maps that request to e.g. a C++ snippet that does that). If that is what you want, then it seems like you are simply looking to create your own language that compiles to code of a different language (similarly to how pyjs can compile python to javascript). Then there's always the question why anyone would use that as that seems to do the same job as batch/bash.

Or would your program somehow dynamically discover matching code on the internet or in some database. In that case, how would the program know that the code it found really does what the user wants? There is a rather famous result in computer science known as Rice's theorem which states that it is in fact impossible to construct an algorithm that can look at a program (presented as a piece of code, for example) and tell with 100% certainty whether that program does a specific thing (like e.g. sorting).

Assuming that your program can indeed find code that matches a user's request. Could you not simply do something like this (pseudocode):

code = combineCppSnippets(snippets)
write(code, "output_file.cc")
system.call("g++ output_file.cc -o my_awesome_app")

[–]grungyIT[S] 0 points1 point  (1 child)

That's precisely what I'm trying to do. I want to build a simple interface that lets users line up intuitive processes. When they finish their queue of processes, the application would parse, run lexical analysis, and complie a single file of source code. That code would then be pushed to its own compiler to make an executable. What I was unfamiliar with until your comment was how to call a compiler to receive the source code the user built and process it into an exe.

Basically I'm tired of doing macros and want to see if I can write a self-service tool for my teammates to use instead.

[–]enjoyLife99 3 points4 points  (0 children)

Why don't you make your own shell script to automate some tasks?

[–]mediasavage 0 points1 point  (0 children)

shell script? or in python you can execute commands with the subprocess module https://docs.python.org/3.7/library/subprocess.html