0

I've deployed a Shiny app on shinyapps.io that executes code that is inserted within the app. For example, if you insert the following code within the app:

1 + 2

The Shiny app returns:

3

This works fine as long as all the packages used in the inserted code have been specified already during the deployment process of the app.

However, if an unknown package is used within the inserted code, the Shiny app doesn't work anymore. For example, the following input returns an error message:

install.packages("Hmisc")
1 + 2

Output:

  'lib = ".../lib/R/library"' is not writable
Warning in install.packages("Hmisc") :
Warning: Error in install.packages: unable to install packages

This could be solved by specifying all required packages (i.e. "Hmisc") during the deployment of the app. However, since I don't know all the required packages before the deployment of the app, I need to find a way to install and load packages AFTER the deployment. How could I do that?

7
  • 2
    What you're doing is dangerous. One can run a system command with your app. Jun 20 at 11:37
  • 2
    Apart from the justified security concerns: Have you tried adding a writable libPath on app or session start? Something like: .libPaths(c(tempdir(), .libPaths())) (I currently can't test it). Jun 22 at 13:59
  • 1
    @ismirsehregal Thank you so much for the code! It seems to work when I specify the repository manually after using your code. I.e. .libPaths(c(tempdir(), .libPaths())) and install.packages("Hmisc", repos = "https://cloud.r-project.org"). Could you elaborate on the security risk in some more detail? I'm afraid I still don't understand why this might be a problem for my app (I don't have much experience with this). Thanks again! Jun 23 at 9:21
  • 2
    @JoachimSchork We can read the Security section from Mastering Shiny. Basically we are allowing the user to run any R code they want. Imagine if a single user wants to throw a Sys.sleep(1e6), then the app could stop working until the sleep finishes. this can affect every user connected if the app runs in a single thread.
    – jpdugo17
    Jun 24 at 1:50
  • 2
    To add up on @jpdugo17' comment: users could download and execute malware. Jun 24 at 2:00

1 Answer 1

2
+50

As per my above comment: we need to add a writable libPath on app or session start.

This can be done by placing the following line of code in the global (app start) or server part (session start) of the app:

.libPaths(c(tempdir(), .libPaths()))

PS: tempdir() can be replaced with any other writable directory and a repository should be provided to install.packages' repos parameter as the R session isn't interactive().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.