dc
8096772119
The four security test programs proved that a bad input aborted the service by reading work.results, the job table %mv_jobflow writes in the Viya branch of %mx_execute. The SASjs Server and SAS 9 branches call %ms_testservice instead, so the table never exists, the data step fails with "File WORK.RESULTS.DATA does not exist." and the assertion reported (0=1) - a failure that says nothing about whether the service validated its input. The platform difference is now in one macro, dc_assert_abort: on Viya it reads the job state as before, elsewhere it looks for the sasjsAbort block that mp_abort leaves in the webout %mx_execute returns through outref. The call to the service stays outside the platform check, so the payloads are submitted on every platform and the assertion is real rather than a skip. Verified on SASjs Server (sas.4gl.io, target sas719, appLoc /Public/app/dc719): the seven abort assertions PASS, i.e. the services do abort on the macro, SQL injection and path traversal payloads. Negative control: the same program with a valid libds reports FAIL (0=1), so the assertion can still fail. sasjs lint: exit 0, no warnings in the five files.
Data Controller for SAS
Control your manual data modifications!
Alternatives to Data Controller include:
- 💾 Developing / testing / deploying / scheduling overnight batch jobs to load files from shared drives
- 🔒 Opening (and locking) datasets in Enterprise Guide or SAS® Table Viewer to perform direct updates
- ❓ Asking a #DBA to run validated code after a change management process
- 🌐 Building & maintaining your own custom web application
- 🏃 Running #SAS or #SQL updates in production
Problems with the above include:
- Legacy 'black box' solutions with little to no testing, documentation or support
- End users requiring direct write access to critical data sources in production
- Upload routines that must be manually modified when the data model changes
- Breaches due to unnecessary parties having access to the data
- Inability to trace who made a change, when, and why
- Reliance on key individuals to perform updates
- Building bespoke ETL for every new data source
- High risk of manual error / data corruption
Data Controller for SAS® solves all these issues in a simple-to-install, user-friendly, secure, documented, battle-tested web application. Available on Viya, SAS 9 EBI, and SASjs Server.
An individual Viya deploy can be done in just 2 lines of #SAS code!
filename dc url "https://git.datacontroller.io/dc/dc/releases/download/latest/viya.sas";
%inc dc;
For a multi-user deploy, using a shared system account, please see deploy docs.
For further information:
- Main site: https://datacontroller.io
- Docs: https://docs.datacontroller.io
- Code: https://code.datacontroller.io
For support, contact support@4gl.io or reach out on Matrix!
Development
Lighthouse CI
This project includes automated Lighthouse performance and accessibility checks that run on pull requests. The checks ensure:
- Accessibility Score: Minimum 1.0 (100%) median score across all tested pages
The Lighthouse CI workflow:
- Sets up the development environment with SASjs server and mocked services
- Builds and serves the Angular frontend
- Installs Chrome and runs
lhci autorun(Lighthouse CI) against key pages - Uploads results as artifacts for review
To run Lighthouse checks locally:
cd client
npm install
npm run lighthouse
Configuration is in client/lighthouserc.js (URL list, desktop preset, Chrome flags, assertions).