= Notes on server security = BOINC scheduling servers, data servers, and web servers must be accessible via HTTP (port 80) and therefore are potential targets for network attacks. The possibility exists that BOINC software could have vulnerabilities to such attacks. == Scheduling server == All network input to the scheduling server is read by calls of the form `fgets(buf, 256, stdin);` where buf is a 256-byte buffer. There is no possibility of a buffer overrun from these calls. In some cases data is copied out of the buffer to a second buffer; this is done using functions (`parse_str()`, `parse_attr()` and `strncpy()`) that take a buffer-length argument, so again there can be no buffer overruns. The scheduling server doesn't run any secondary programs. The scheduling server creates disk files in which it stores request and reply messages. These files have names of the form `PATH/sched_req_PID` where `PATH` is a compiled-in directory name (e.g. `/tmp`) and `PID` is the server process ID. There is no possibility of the server creating executable files, or files in other directories. == File upload handler == The file upload handler parses its input in the same way as the scheduling servers, except for file data. This data is read using `fread()` in fixed-sized increments. So there are no buffer overruns. The file upload handler reads and writes files with names of the form `BOINC_UPLOAD_DIR/filename`, where BOINC_UPLOAD_DIR is a compiled constant for the directory where data files are stored. 'filename' is checked for '..' and such requests are ignored. Hence files outside the directory cannot be read or written. The only place where files are created (in `copy_socket_to_file()`) is a call '`fopen(path, "wb");`'. Hence no executable files or links are created.