Skip to content

Commit

Permalink
Protect __evaluate_entry and __evaluate_exit callbacks. (#700)
Browse files Browse the repository at this point in the history
These two internal APIs are very useful in debugging scenarios, and for imposing time/depth constraints on queries.
However, this internal API should only be accessible when configuring an expression programmatically, and not
from inside of a query. Otherwise, a query can be manipulated to remove such diagnostics or constraints.

By changing both binding keys to Symbol, they can no longer be accessed inside of the query since the Symbol API
is not accessible there.
  • Loading branch information
adamscybot authored Nov 26, 2024
1 parent 9e6b8e6 commit 3b662f0
Show file tree
Hide file tree
Showing 4 changed files with 8 additions and 8 deletions.
4 changes: 2 additions & 2 deletions jsonata.d.ts
Original file line number Diff line number Diff line change
Expand Up @@ -50,8 +50,8 @@ declare namespace jsonata {
}

interface Environment {
bind(name: string, value: any): void;
lookup(name: string): any;
bind(name: string | symbol, value: any): void;
lookup(name: string | symbol): any;
readonly timestamp: Date;
readonly async: boolean;
}
Expand Down
4 changes: 2 additions & 2 deletions src/jsonata.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ var jsonata = (function() {
async function evaluate(expr, input, environment) {
var result;

var entryCallback = environment.lookup('__evaluate_entry');
var entryCallback = environment.lookup(Symbol.for('jsonata.__evaluate_entry'));
if(entryCallback) {
await entryCallback(expr, input, environment);
}
Expand Down Expand Up @@ -124,7 +124,7 @@ var jsonata = (function() {
result = await evaluateGroupExpression(expr.group, result, environment);
}

var exitCallback = environment.lookup('__evaluate_exit');
var exitCallback = environment.lookup(Symbol.for('jsonata.__evaluate_exit'));
if(exitCallback) {
await exitCallback(expr, input, environment, result);
}
Expand Down
4 changes: 2 additions & 2 deletions test/implementation-tests.js
Original file line number Diff line number Diff line change
Expand Up @@ -1057,11 +1057,11 @@ function timeboxExpression(expr, timeout, maxDepth) {
};

// register callbacks
expr.assign("__evaluate_entry", function() {
expr.assign(Symbol.for('jsonata.__evaluate_entry'), function() {
depth++;
checkRunnaway();
});
expr.assign("__evaluate_exit", function() {
expr.assign(Symbol.for('jsonata.__evaluate_exit'), function() {
depth--;
checkRunnaway();
});
Expand Down
4 changes: 2 additions & 2 deletions test/run-test-suite.js
Original file line number Diff line number Diff line change
Expand Up @@ -178,12 +178,12 @@ function timeboxExpression(expr, timeout, maxDepth) {
};

// register callbacks
expr.assign("__evaluate_entry", function(expr, input, env) {
expr.assign(Symbol.for('jsonata.__evaluate_entry'), function(expr, input, env) {
if (env.isParallelCall) return;
depth++;
checkRunnaway();
});
expr.assign("__evaluate_exit", function(expr, input, env) {
expr.assign(Symbol.for('jsonata.__evaluate_exit'), function(expr, input, env) {
if (env.isParallelCall) return;
depth--;
checkRunnaway();
Expand Down

0 comments on commit 3b662f0

Please sign in to comment.