Do the javascript front end functions have access to the host OS?

Umb

Do the javascript front end functions have access to the host OS? I'd like to get it to run a dos command

gabriel

Especially for web applications, OS access is a complicated topic - and it should be given how dangerous this can be. Frontend functions in r3 run in the browser sandbox and have therefore no access to the OS.

We have a client application, which can access hotkeys on the client to execute things in r3. But nothing like you ask, sorry.

Umb

Is there any way I can permanently add child_process to my installation of R3 server as the import or require commands won’t work currently. Also can you tell me the type & version of JavaScript being used in R3?

gabriel

Frontend functions are there to interact with r3 entities via system calls (instance functions) or placeholders (global frontend functions, backend calls, etc.). You cannot import modules, talk to the DOM or access the host OS. It is a simple scripting environment for executing logic, working with data, etc.

r3 does not run on something like node.js - frontend functions do not leave your browser and use the browser provided JavaScript. Which version that is, depends on the browser. Usually browsers do not implement a fixed JS version, but add more and more support for new ECMAScript standards.

Umb

OK - I think I almost have it - I have written a simple python server that runs on the localhost and only accepts incoming requests from the localhost - it retrieves the data and sends it back as a webpage with the raw data in the body. The only problem I have now is that on the front end script the body is null - it doesn't return any errors at all - how do I retrieve the data ?

Here's the front end script;
async function put() {
await fetch("http://127.0.0.1:8080", {
method: 'GET',
mode: "no-cors",
headers: {
'Content-type': 'text/html'
},
}).then(
res => {
// res has the result body, this could be JSON, XML or anything else
const data = res.body
console.log(data);
},
err => {
// the error case is handled here, err contains the error message
alert(err);
}
);
}
put()

With me being an absolute noob at this I assume I'm probably just missing something simple ... right? :

gabriel

Try to write res to the console instead of res.data. I assume that you get plain text back and need to parse it to JSON via JSON.parse().

Umb

it's returned as csv text but using data hasn't helped ...

this:

async function put() {
const response = await fetch("http://127.0.0.1:8080", {
method: 'GET',
mode: "no-cors",
headers: {
'Content-type': 'text/html'
},
}).then(
res => {
// res has the result body, this could be JSON, XML or anything else
console.log (res.data);
},
err => {
// the error case is handled here, err contains the error message
alert(err);
}
);
}
put();

produced this:

and clicking through to identify the line it highlighted this:

gabriel

You misunderstood - you need to check res not data or res.data.
If you get the variable res filled, there is something there - you do not know what it is currently, but something has returned from the call.

So please, do console.log(res) and post the result.

res.data would require an object, which you probably do not have at this point.

Umb

This is what I got:

These are the headers my python server received:
Server started http://localhost:8080
127.0.0.1 - - [26/Jan/2025 20:56:15] "GET / HTTP/1.1" 200 -
Host: 127.0.0.1:8080
Connection: keep-alive
sec-ch-ua-platform: "Windows"
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0
Accept: /
sec-ch-ua: "Not A(Brand";v="8", "Chromium";v="132", "Microsoft Edge";v="132"
sec-ch-ua-mobile: ?0
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: empty
Referer: http://localhost:57724/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9,en-GB;q=0.8

gabriel

A response status code of 0 could mean that the endpoint refused to answer - though because you implemented your own endpoint, that does not have to be the case.

Other than that, it looks pretty much like what you would want to get from a REST call. If your REST endpoint (from your Python script) delivers a body, you would find it in res.body. It is not displayed in your screenshot, but you can click on the (...) to show the contents of the response body.

Umb

Hey hey - I got it! there was no data being sent through was because I was trying to use a "no-cors" in the request header! As soon as I sorted that out and worked out how to read the stream object it works just fine. Thank you Gabriel for your patience with this utter noob 😉

For anyone who's interested - this is my front end script;

async function fetchAndReadStream() {
try {
// Send a GET request to the server
const response = await fetch("http://127.0.0.1:8000", {
method: 'GET',
mode: "cors",
headers: {
'Content-type': 'text/html',
'Accept': 'text/html'
}
});
console.log(response)
let result = ''
// Check if the response body is a readable stream
if (response.body) {
// Create a reader from the response body
const reader = response.body.getReader();
let decoder = new TextDecoder(); // To decode stream chunks into text
while (true) {
// Read the next chunk
const {
done,
value
} = await reader.read();
if (done) {
break; // Stream has finished
}
result += decoder.decode(value, {
stream: true
}); // Decode and append chunk
}
console.log('Received stream content:', result);
// Optionally render the content in the browser
} else {
console.log('No readable stream found in the response body.');
}
} catch (error) {
console.error('Error fetching or reading the stream:', error);
}
}
// Call the function to fetch and read the stream
fetchAndReadStream();

and this is my python server script;

from http.server import HTTPServer, BaseHTTPRequestHandler
import subprocess
import sys
class CORSRequestHandler(BaseHTTPRequestHandler):
def _set_headers(self):
print("Setting response headers")
self.send_response(200)
self.send_header("Content-Type", "text/html")
self.send_header("Access-Control-Allow-Origin", "*")
self.send_header("Access-Control-Allow-Methods", "*")
self.send_header("Access-Control-Allow-Headers", "*")
self.end_headers()
def do_GET(self):
print("Handle GET request")
self._set_headers()
subprocess.run("curl -o c:\test\test.csv \"https://myimaginarywebsite.com/getdata\"")
in_file = open("c:\test\test.csv", "rb")
data = in_file.read()
in_file.close()
print("writing data")
self.wfile.write(bytes("<html><head><title>Returned Data</title></head>", "utf-8"))
self.wfile.write(bytes("<body>", "utf-8"))
self.wfile.write(bytes(data))
self.wfile.write(bytes("</body></html>", "utf-8"))
self.close_connection
def do_OPTIONS(self):
print("Handle preflight OPTIONS requests for CORS")
self.send_response(200)
self.send_header("Access-Control-Allow-Origin", "*")
self.send_header("Access-Control-Allow-Methods", "*")
self.send_header("Access-Control-Allow-Headers", "*")
self.end_headers()
if __name__ == "__main__":
host = "localhost"
port = 8000
server = HTTPServer((host, port), CORSRequestHandler)
print(f"Server running at {host}:{port}")
try:
server.serve_forever()
except KeyboardInterrupt:
print("\nShutting down server...")
server.server_close()