Skip to content

Commit

Permalink
Update about.md (tableau#313)
Browse files Browse the repository at this point in the history
* Update about.md

Minor text change.

* Revert "Update about.md"

This reverts commit 18ecbb5.

* Minor text edits. Let's see if I finally have VS configured properly to get the word wrapping issues which have caused stupid build breaks resolved.

* Text request as per NMannheimer.

* Update security.md

* Update security.md
  • Loading branch information
VTucherov authored and 0golovatyi committed Jul 22, 2019
1 parent fd5ffc7 commit fc5a883
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 16 deletions.
4 changes: 2 additions & 2 deletions docs/about.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ TabPy framework allows Tableau to remotely execute Python code. It has two compo
executed or persisted in the server process and exposed as a REST endpoint,
to be called later.

2. A [tools library](tabpy-tools.md) that enables the deployment of such endpoints,
based on Python functions.
2. A [tools library](tabpy-tools.md),
based on Python functions which enables the deployment of such endpoints.

Tableau can connect to the TabPy server to execute Python code on the fly and
display results in Tableau visualizations. Users can control data and parameters
Expand Down
29 changes: 16 additions & 13 deletions docs/security.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,18 @@
# TabPy Security Considerations

The following security issues should be kept in mind as you use TabPy with Tableau:

- tabpy_tools client does not validate that the tabpy server cert is signed
by a trusted CA
- REST server and Python execution context are the same meaning they share
Python session, e.g. HTTP requests are served in the same space where
user scripts are evaluated.
- Python scripts can contain code which can harm security on the server where
the TabPy is running. For example:
- Access file system (read/write)
- Install new Python packages which can contain binary code
- Execute operating system commands
- Open network connections to other servers and download files
If security is a significant concern within your organization,
you may want to consider the following as you use TabPy:

•The REST server and Python execution share the same Python session,
meaning that HTTP requests and user scripts are evaluated in the
same addressable memory and processor threads.
•The tabpy_tools client does not validate that the tabpy server
certificate is signed by a trusted CA.

Python scripts can contain code which can harm security on the server
where the TabPy is running. For example, Python scripts can:

•Access the file system (read/write).
•Install new Python packages which can contain binary code.
•Execute operating system commands.
•Open network connections to other servers and download files.
2 changes: 1 addition & 1 deletion docs/server-startup.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Starting TabPy Server
# Setup and Startup TabPy Server

These instructions explain how to start up TabPy Server.

Expand Down

0 comments on commit fc5a883

Please sign in to comment.