# Send serialized object to DS server

**URL:** <https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330>\
**Category:** Developer support\
**Created:** [11 December 2020 10:46 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330 "2020-12-11T10:46:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xescriba](https://avatars.discourse-cdn.com/v4/letter/x/ee59a6/32.png) [@xescriba](https://datashield.discourse.group/u/xescriba)\
**Post date:** [11 December 2020 10:46 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330/1 "2020-12-11T10:46:51Z")

</div>

I would like to send to the DS server a serialized R object. I’m trying the following (the _ **questions** _ variable is the object to be serialized):

```
cally <- paste0("prepare_dataset_treeDS(", data, ", ", serialize(questions, NULL), ")")
DSI::datashield.assign.expr(datasources, "tree_data", as.symbol(cally))

```

It’s not working as the code is generating multiple cally’s, each one with a byte of the raw serialized object

```
"prepare_dataset_treeDS(D, 58)" "prepare_dataset_treeDS(D, 0a)" "prepare_dataset_treeDS(D, 00)" etc

```

Anyone knows the correct way of sending serialized objects?

---

<div class="post-metadata">

**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\
**Post date:** [11 December 2020 11:37 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330/2 "2020-12-11T11:37:10Z")

</div>

Hi,

The DataSHIELD’s R parser does not allow to send complex function parameters, to prevent from code injection.

Yannick

---

<div class="post-metadata">

**Author:** ![xescriba](https://avatars.discourse-cdn.com/v4/letter/x/ee59a6/32.png) [@xescriba](https://datashield.discourse.group/u/xescriba)\
**Post date:** [11 December 2020 12:14 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330/3 "2020-12-11T12:14:56Z")

</div>

I found a way of achieving it, i’m not sure if it’s compromising though.

On the client:

```
cally <- paste0("prepare_dataset_treeDS(", data, ", '", sf::rawToHex(serialize(questions, NULL)), "')")
DSI::datashield.assign.expr(datasources, "tree_data", as.symbol(cally))

```

On the server:

```
questions <- unserialize(wkb::hex2raw(questions))

```

This passes successfully a serialized object.

---

<div class="post-metadata">

**Author:** ![yannick](https://yyz2.discourse-cdn.com/free1/user_avatar/datashield.discourse.group/yannick/32/19_2.png) [@yannick](https://datashield.discourse.group/u/yannick)\
**Post date:** [11 December 2020 12:47 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330/4 "2020-12-11T12:47:50Z")

</div>

It passes the R parser barrier, but it makes your server side code very vulnerable, as a function could be sent this way.

---

<div class="post-metadata">

**Author:** ![xescriba](https://avatars.discourse-cdn.com/v4/letter/x/ee59a6/32.png) [@xescriba](https://datashield.discourse.group/u/xescriba)\
**Post date:** [11 December 2020 14:49 UTC](https://datashield.discourse.group/t/send-serialized-object-to-ds-server/330/5 "2020-12-11T14:49:15Z")

</div>

On the functionality I’m working on, I’m passing a table (variable rows but standardized columns and column types), performing a class check would be enough to overcome the vulnerability? Eg on the server side:

```
if(class(questions) != "data.frame"){stop()}

```

Plus checking the column number and column types are the ones expected.