-1

Here is my code so far.

<html>
<head>
<script language="JavaScript">
function java(){
process process = new ProcessBuilder("Pathtomyprogram").start();
}
</script>
</head>
<form name="Test">
<input type="button" value="Test" onClick="java()">
</form>
</body>
</html>

The problems happen when I go in my web browser and click the button that I created and it doesn't start the program I specified on the host computer. I may be making a completely obvious mistake as I have been stitching together code from multiple sources. So basically, how can I start a program by opening my website (on which the javascript is hosted) on say my phone and after clicking the button it opens a program on the host computer?

If this isn't possible and I've been a complete moron, please let me know!

This javascript is being hosted on Apache 2.2 on a Windows XP PC if that was necessary to know.

Edit: Wow, I was really dumb in that question from awhile ago. Ok, so I realize my question was not formed well AT all. Here is how to do it instead.

My solution was found in PHP and is very sloppy and should NOT be used at all, but here it is for anyone who needed to do what I was doing.

Ok, so the thing is, as many people have pointed out below, it is just too risky to allow programs to be started on a server from a client. There is NO pure way around this, but there's a sneaky, impractical way.

<?php
 function play() {
 $myfile = fopen("start.txt", "w") or die("Unable to open file!");
 }
?>

What this does is write "w" to a "start.txt" file on the server. There is also a batch program (doesn't have to be batch obviously) running on the server looking to see if "start.txt" exists. If it does, it runs the thing I wanted it to, then deletes "start.txt" so as to reset it for the next time.

Here's the "batch.bat" code for anyone interested, of course.

@echo off
:home
if exist start.txt goto next
goto home
:next
rem Code you want to be executed goes here.
cls
del start.txt
goto home

But really, unless this is something you or a small selection of friends that you trust will use, never do this. I am much wiser and know more about javascript and web programming in general now, and this, even I can recognise, is a horrible fix. Thanks!

R2bEEaton
  • 51
  • 1
  • 10
  • 1
    This doesn't look like valid JavaScript *at all*. `process process`? What is `ProcessBuilder`? Unless you have some plugin installed in the browser, the browser isn't going to allow you to execute programs on the computer for obvious security reasons. – David Aug 12 '17 at 23:39
  • I'm sorry if my javascript does not look valid because I myself have no idea if it is or not. How can I get a plugin thag would bypass this security. – R2bEEaton Aug 12 '17 at 23:40
  • I'm not aware of one, mostly because there really isn't ever a need for one. Things that *bypass security* tend not to be desirable things. – David Aug 12 '17 at 23:42
  • So just to clarify, are you saying that it is not possible to start a program on the host computer from JS on Apache? – R2bEEaton Aug 12 '17 at 23:44
  • Apache has nothing to do with it. You may be able to execute something from Apache *itself* with some server-side code. But by default it's not possible to do this from JavaScript in the browser. Imagine a world where any website you visit could launch programs on your computer. I guess more to the point of this question... You certainly can't execute programs by typing random things which look like code into your JavaScript code and hoping for the best. It's not clear where you got the code you've written or what you were expecting from it, really. – David Aug 12 '17 at 23:46
  • See [PHP - exec() vs system() vs passthru()](https://stackoverflow.com/questions/732832/php-exec-vs-system-vs-passthru), [WebAssembly Concepts](https://developer.mozilla.org/en-US/docs/WebAssembly/Concepts) – guest271314 Aug 12 '17 at 23:54
  • @guest271314 I don't see how PHP is helping here unless the web server resides on same host as the browser. In addition WebAssembly still seems to be limited in accessing the underlying operating system. – Thomas Urban Aug 13 '17 at 00:25
  • @cepharum Another option is to use a custom protocol handler – guest271314 Aug 13 '17 at 00:30
  • @guest271314 Indeed, as mentioned in comments to by answer below this option is available, but requires additional action on host of any visitor. The programme to be started has to be associated with a URL scheme. – Thomas Urban Aug 13 '17 at 00:32
  • @cepharum It depends on what OP means by "a program". The requirement should be possible. – guest271314 Aug 13 '17 at 00:33
  • @R2bEEaton_ Realizing you want to use your phone to start some program on host. Maybe you need to clarify what scenario you are trying to establish and who is going to use it at all. Basically, "hosting Javascript **on** Apache" is a bit confusing here. Apache is delivering the HTML containing Javascript to be run inside browser. You might stick with PHP to have server-side script running "in reach" of Apache which might start program using system() or exec() as linked by guest271314 before. – Thomas Urban Aug 13 '17 at 00:34
  • @cepharum There are a variety of options available, if gather gist of expected result correctly. Certainly more detail could be included at OP. – guest271314 Aug 13 '17 at 00:35
  • @cepharum `requestFileSystem` writes data to chromium, chrome configuration folder. `chrome.fileSystem` allows writing files to any directory at user filesystem user provides permission for the chrome app to write to. A `cron` job at host computer can be used to read files created at a specific directory and perform the task specified in the file. – guest271314 Aug 13 '17 at 00:42
  • @guest271314 Yes, and you might even patch and build your own Chrome/Firefox to achieve that as well. I'm aware of all kinds of hackish approaches to this issue. Nonetheless there is no way to simply run any program using Javascript in a common unpatched browser without user having to associate the application with URL scheme first. – Thomas Urban Aug 13 '17 at 00:45
  • @cepharum _"Nonetheless there is no way to simply run any program using Javascript in a common unpatched browser without user having to associate the application with URL scheme first."_ What do you mean by "URL scheme"? A patch is not necessary to use `webkitRequestFileSystem` or `chrome.fileSystem`, or `localStorage` for that matter. The host machine can read any file in any directory at the host filesystem, given correct permissions. – guest271314 Aug 13 '17 at 00:47
  • Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/151807/discussion-between-cepharum-and-guest271314). – Thomas Urban Aug 13 '17 at 00:48
  • Possible, look up launching a program with a URL schema – Bailey Miller Aug 13 '17 at 01:59

1 Answers1

1

If this isn't possible and I've been a complete moron, please let me know!

It's not possible for security reasons, so ;) ... at least it doesn't work as simple as sketched in your question.

Your code is running in a browser which is putting your document and the contained javascript in a "sandbox" preventing it from accessing anything outside of browser which is any other program on the host.

Concluding from comments here and on question:

  • If you are using Javascript in context of an HTML document to be rendered in a browser this code runs in context of that browser which is at least requiring special (manual) setup to provide opportunities for running software on host running the browser. E.g., browser and/or operating system provide mapping tables associating URL schemes with programs to be invoked for handling either URL.
  • Since you indicate trying to run a program on host when watching your website on phone this seems to be completely different: Javascript is running on your phone then and definitely can't magically start some program on host running the server. It thus looks like you want to use PHP or a similar server-side scripting language to provide a URL for triggering program execution. PHP isn't bound to some browser's sandbox, but bound to the host (in fact it's the server here) computer. Your button then might simply cause the browser to request that script's output (probably using Javascript for that) resulting in Apache/PHP running the script which in turn is using PHP's exec() to start the application on host a.k.a. server.
Thomas Urban
  • 4,649
  • 26
  • 32
  • So the sandbox doesn't communicate at all with the host computer? – R2bEEaton Aug 13 '17 at 00:04
  • It depends on what you mean by _communicating_. There are certains interfaces available to the code inside the sandbox. Most of them might be considered passive, such as detecting current platform, the screen size or similar. That's _communication_ as well. Further APIs provide access on selected information such as current geo-location, but require user to confirm this. You can even access media devices attached to the computer. But you can't start separate programs arbitrarily. – Thomas Urban Aug 13 '17 at 00:10
  • Here's an example. When one clicks this link https://discordapp.com/invite/E3dBWE it has a button that says "Accept Invite." When one clicks this button, it asks if you want to open discord or not. If you select yes then it opens the discord application on the computer of the person who clicked the button. If it can do that, why can it not (when given permission to) open programs on the host computer? Also yes, I know this isn't a true example because in this example you click the button and it opens for you, not the host. – R2bEEaton Aug 13 '17 at 00:17
  • I didn't get this far ... most probably this link is redirecting browser to some URL associated with an existing application to process whatever is included with the URL's remainder. That's like redirecting to `mailto:foo@example.com` opening your default mail application. Still, this requires user to install an application that registers an individual URL scheme (here: `mailto`) with the operating system or at least the browser needs to know some mapping for it. Discord most probably redirects to Windows Store, doesn't it? – Thomas Urban Aug 13 '17 at 00:22
  • _"It's not possible"_ Is not entirely accurate – guest271314 Aug 13 '17 at 00:45