Skip to content

Commit 3b662f0

Browse files
authored
Protect __evaluate_entry and __evaluate_exit callbacks. (#700)
These two internal APIs are very useful in debugging scenarios, and for imposing time/depth constraints on queries. However, this internal API should only be accessible when configuring an expression programmatically, and not from inside of a query. Otherwise, a query can be manipulated to remove such diagnostics or constraints. By changing both binding keys to Symbol, they can no longer be accessed inside of the query since the Symbol API is not accessible there.
1 parent 9e6b8e6 commit 3b662f0

File tree

4 files changed

+8
-8
lines changed

4 files changed

+8
-8
lines changed

jsonata.d.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ declare namespace jsonata {
5050
}
5151

5252
interface Environment {
53-
bind(name: string, value: any): void;
54-
lookup(name: string): any;
53+
bind(name: string | symbol, value: any): void;
54+
lookup(name: string | symbol): any;
5555
readonly timestamp: Date;
5656
readonly async: boolean;
5757
}

src/jsonata.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ var jsonata = (function() {
5050
async function evaluate(expr, input, environment) {
5151
var result;
5252

53-
var entryCallback = environment.lookup('__evaluate_entry');
53+
var entryCallback = environment.lookup(Symbol.for('jsonata.__evaluate_entry'));
5454
if(entryCallback) {
5555
await entryCallback(expr, input, environment);
5656
}
@@ -124,7 +124,7 @@ var jsonata = (function() {
124124
result = await evaluateGroupExpression(expr.group, result, environment);
125125
}
126126

127-
var exitCallback = environment.lookup('__evaluate_exit');
127+
var exitCallback = environment.lookup(Symbol.for('jsonata.__evaluate_exit'));
128128
if(exitCallback) {
129129
await exitCallback(expr, input, environment, result);
130130
}

test/implementation-tests.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1057,11 +1057,11 @@ function timeboxExpression(expr, timeout, maxDepth) {
10571057
};
10581058

10591059
// register callbacks
1060-
expr.assign("__evaluate_entry", function() {
1060+
expr.assign(Symbol.for('jsonata.__evaluate_entry'), function() {
10611061
depth++;
10621062
checkRunnaway();
10631063
});
1064-
expr.assign("__evaluate_exit", function() {
1064+
expr.assign(Symbol.for('jsonata.__evaluate_exit'), function() {
10651065
depth--;
10661066
checkRunnaway();
10671067
});

test/run-test-suite.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,12 +178,12 @@ function timeboxExpression(expr, timeout, maxDepth) {
178178
};
179179

180180
// register callbacks
181-
expr.assign("__evaluate_entry", function(expr, input, env) {
181+
expr.assign(Symbol.for('jsonata.__evaluate_entry'), function(expr, input, env) {
182182
if (env.isParallelCall) return;
183183
depth++;
184184
checkRunnaway();
185185
});
186-
expr.assign("__evaluate_exit", function(expr, input, env) {
186+
expr.assign(Symbol.for('jsonata.__evaluate_exit'), function(expr, input, env) {
187187
if (env.isParallelCall) return;
188188
depth--;
189189
checkRunnaway();

0 commit comments

Comments
 (0)