MaplePrimes - answers and comments on Question, JDBC connection to mySQL database from MapleNet

Web Service

Will — Mon, 01 Nov 2010 17:58:12 Z

I doubt that it's possible for a Maplet to load up a remotely served JAR file. It seems to me that this would be a huge security loophole in Java, so I doubt it's allowed.

My suggestion would be for you to do all of your MySQL access in a webservice on your own server. Then just have the Maplet access the results of the webservice instead of going into the database directly.

You usually don't want to allow users to directly access your database anyhow, since you would have to include the MySQL login credentials in your Maplet. It would be possible for someone to figure out the username/password by packet sniffing and then they would be able to execute arbitrary commands on your database. By creating a webservice and having all interaction go through the service, you are greatly increasing the security of your database.

____

William Spaetzel
MaplePrimes Administrator
Software Developer, Maplesoft

Maplet Code runs on the Server

Bill — Wed, 03 Nov 2010 18:42:41 Z

Doug

The code for the Maplet runs on the Server. Only the visual representation of the Maplet is 'running' on the Client browser. So the path to the JDBC jar should point to the jar where it exists on the Server file system. Also the owner of the Tomcat process should be given read access to this directory.

Bill H

clarification, and question

Doug Meade — Mon, 01 Nov 2010 19:09:08 Z

Will,

There is nothing that prevents a Maplet from accessing a database. I have done this when the Maplet is being run on my local computer (and the database is on another server). My question was how to get this to work when the Maplet is being run on the server, via MapleNet.

Maybe your answer is that MapleNet does not allow this, based on security concerns. If so, I hope you will say so explicitly - with appropriate modifications to your reasoning.

I'm not sure I know what you mean by a "webservice". Can you elaborate on this?

I'll check back after class.

Doug

---------------------------------------------------------------------
Douglas B. Meade  <><
Math, USC, Columbia, SC 29208  E-mail: mailto:meade@math.sc.edu
Phone:  (803) 777-6183         URL:    http://www.math.sc.edu

Database access

Will — Mon, 01 Nov 2010 19:57:21 Z

@Doug Meade Yes, my answer is that (as far as I know) MapleNet does not allow this based on security reasons. Loading the JDB over the internet is dangerous as it would allow potentially malicious code to be injected into the Maplet.

By web service I mean a simple page that your Maplet could load to get the data from the database. For example, if your Maplet needs to load up a list of people's names with a search parameter. The Maplet could load this URL from your server:

http://myserver/loadnames.php?term=will

Then the PHP page would list off the results

Will Spaetzel
John Williamson
William Smith

It would be simple for you to parse the results in your Maplet, and then make use of that data.

MapleNet, JDBC, PHP followup

Doug Meade — Wed, 03 Nov 2010 17:41:09 Z

@Will Your comments are in italics, and indented.

I doubt that it's possible for a Maplet to load up a remotely served JAR file. It seems to me that this would be a huge security loophole in Java, so I doubt it's allowed.

OK. But, what about a locally served JAR file, that is, oneon the MapleNet server?

http://myserver/loadnames.php?term=will

But, to the best of my knowledge it is not possible to put a URL like this in a Maplet. Maybe I could have a button that uses the system command to run the PHP code on the server, writing results to a file that can then be accessed by code within the Maplet. But, doesn't this have the same (or more) security concerns?

Last month, in response to a question under the title "Open URL" (http://www.mapleprimes.com/questions/97949-External-Communication-With-Maplet#comment97950) you suggested having a Close button open a webpage. I did discover that this is possible - by using the system (or ssystem) command with the command being "open <some URL>". This appears to work for several combinations of OS and browser, but I've not yet determined that it will work for all cases. This question is different - at least in some respects.

Have others wanted to do anything like this?

Doug

P.S. I received (at least) four notices that you had responded to my question. The timestamps are 10:45am, 12:45pm, 2:45pm, and 4:45pm.

it works!

Doug Meade — Thu, 04 Nov 2010 10:11:01 Z

This is what I thought I was trying to do.

When I was putting together my response to tell you how this did not work - it worked!

I don't know what I am now doing differently, but all is now working as it should.

Thanks for your support and patience as I came to this realization.

Doug

---------------------------------------------------------------------
Douglas B. Meade  <><
Math, USC, Columbia, SC 29208  E-mail: mailto:meade@math.sc.edu
Phone:  (803) 777-6183         URL:    http://www.math.sc.edu