You are viewing a plain text version of this content. The canonical link for it is here.
Posted to pr@jena.apache.org by "afs (via GitHub)" <gi...@apache.org> on 2023/06/14 19:36:17 UTC
[GitHub] [jena] afs opened a new pull request, #1908: An allow list of function names
afs opened a new pull request, #1908:
URL: https://github.com/apache/jena/pull/1908
Pull request Description:
Give some more control over script functions. Have a list of callable functions which is checked by java.
----
- [x] Tests are included.
- [x] Documentation change and updates are provided for the [Apache Jena website](https://github.com/apache/jena-site/)
By submitting this pull request, I acknowledge that I am making a contribution to the Apache Software Foundation under the terms and conditions of the [Contributor's Agreement](https://www.apache.org/licenses/contributor-agreements.html).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org
[GitHub] [jena] afs merged pull request #1908: An allow list of function names
Posted by "afs (via GitHub)" <gi...@apache.org>.
afs merged PR #1908:
URL: https://github.com/apache/jena/pull/1908
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org
[GitHub] [jena] kinow commented on a diff in pull request #1908: An allow list of function names
Posted by "kinow (via GitHub)" <gi...@apache.org>.
kinow commented on code in PR #1908:
URL: https://github.com/apache/jena/pull/1908#discussion_r1231503330
##########
jena-arq/src/main/java/org/apache/jena/sparql/function/scripting/ScriptFunction.java:
##########
@@ -88,28 +94,65 @@ public static boolean isScriptFunction(String uri) {
return langPart.endsWith(FUNCTION_SUFFIX);
}
+ public ScriptFunction() { }
+
@Override
public void checkBuild(String uri, ExprList args) {
+ throw new IllegalStateException("ScriptFunction.checkBuild called");
+ }
+
+ @Override
+ public void build(String uri, ExprList args, Context cxt) {
checkScriptingEnabled();
if (!isScriptFunction(uri))
throw new ExprException("Invalid URI: " + uri);
String localPart = uri.substring(ARQ_NS.length());
int separatorPos = localPart.indexOf('#');
this.lang = localPart.substring(0, separatorPos - FUNCTION_SUFFIX.length());
this.name = localPart.substring(separatorPos + 1);
-
- // Check for bare names that are provided by the language e.g. 'eval' which
- // is a JS and Python built-in function and always available.
- if ( lang.toLowerCase(Locale.ROOT).contains("python") ) {
- if ( Objects.equals("eval", name) || Objects.equals("exec", name) )
- throw new ExprException(lang+" function '"+name+"' is not allowed");
- } else {
- // Assume javascript.
- if ( Objects.equals("eval", name) )
- throw new ExprException("JS function '"+name+"' is not allowed");
+ this.allowList = allowList(cxt, ARQ.symCustomFunctionScriptAllowList);
+
+ String cname = lang.toLowerCase(Locale.ROOT);
+ switch(cname) {
+ case "js":
+ // never allow these.
+ this.denyList = Set.of("eval", "load");
+ check(lang, name, allowList, denyList);
+ break;
+ case "python":
+ // never allow these.
+ this.denyList = Set.of("eval");
Review Comment:
I don't know if there's a good list of functions and modules to sandbox in Python. Maybe `exec` too? It looks like it was removed in the diff above?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org
[GitHub] [jena] afs commented on a diff in pull request #1908: An allow list of function names
Posted by "afs (via GitHub)" <gi...@apache.org>.
afs commented on code in PR #1908:
URL: https://github.com/apache/jena/pull/1908#discussion_r1233072987
##########
jena-arq/src/main/java/org/apache/jena/sparql/function/scripting/ScriptFunction.java:
##########
@@ -88,28 +94,65 @@ public static boolean isScriptFunction(String uri) {
return langPart.endsWith(FUNCTION_SUFFIX);
}
+ public ScriptFunction() { }
+
@Override
public void checkBuild(String uri, ExprList args) {
+ throw new IllegalStateException("ScriptFunction.checkBuild called");
+ }
+
+ @Override
+ public void build(String uri, ExprList args, Context cxt) {
checkScriptingEnabled();
if (!isScriptFunction(uri))
throw new ExprException("Invalid URI: " + uri);
String localPart = uri.substring(ARQ_NS.length());
int separatorPos = localPart.indexOf('#');
this.lang = localPart.substring(0, separatorPos - FUNCTION_SUFFIX.length());
this.name = localPart.substring(separatorPos + 1);
-
- // Check for bare names that are provided by the language e.g. 'eval' which
- // is a JS and Python built-in function and always available.
- if ( lang.toLowerCase(Locale.ROOT).contains("python") ) {
- if ( Objects.equals("eval", name) || Objects.equals("exec", name) )
- throw new ExprException(lang+" function '"+name+"' is not allowed");
- } else {
- // Assume javascript.
- if ( Objects.equals("eval", name) )
- throw new ExprException("JS function '"+name+"' is not allowed");
+ this.allowList = allowList(cxt, ARQ.symCustomFunctionScriptAllowList);
+
+ String cname = lang.toLowerCase(Locale.ROOT);
+ switch(cname) {
+ case "js":
+ // never allow these.
+ this.denyList = Set.of("eval", "load");
+ check(lang, name, allowList, denyList);
+ break;
+ case "python":
+ // never allow these.
+ this.denyList = Set.of("eval");
Review Comment:
Added (amended a commit several places back).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org
[GitHub] [jena] afs commented on a diff in pull request #1908: An allow list of function names
Posted by "afs (via GitHub)" <gi...@apache.org>.
afs commented on code in PR #1908:
URL: https://github.com/apache/jena/pull/1908#discussion_r1233072987
##########
jena-arq/src/main/java/org/apache/jena/sparql/function/scripting/ScriptFunction.java:
##########
@@ -88,28 +94,65 @@ public static boolean isScriptFunction(String uri) {
return langPart.endsWith(FUNCTION_SUFFIX);
}
+ public ScriptFunction() { }
+
@Override
public void checkBuild(String uri, ExprList args) {
+ throw new IllegalStateException("ScriptFunction.checkBuild called");
+ }
+
+ @Override
+ public void build(String uri, ExprList args, Context cxt) {
checkScriptingEnabled();
if (!isScriptFunction(uri))
throw new ExprException("Invalid URI: " + uri);
String localPart = uri.substring(ARQ_NS.length());
int separatorPos = localPart.indexOf('#');
this.lang = localPart.substring(0, separatorPos - FUNCTION_SUFFIX.length());
this.name = localPart.substring(separatorPos + 1);
-
- // Check for bare names that are provided by the language e.g. 'eval' which
- // is a JS and Python built-in function and always available.
- if ( lang.toLowerCase(Locale.ROOT).contains("python") ) {
- if ( Objects.equals("eval", name) || Objects.equals("exec", name) )
- throw new ExprException(lang+" function '"+name+"' is not allowed");
- } else {
- // Assume javascript.
- if ( Objects.equals("eval", name) )
- throw new ExprException("JS function '"+name+"' is not allowed");
+ this.allowList = allowList(cxt, ARQ.symCustomFunctionScriptAllowList);
+
+ String cname = lang.toLowerCase(Locale.ROOT);
+ switch(cname) {
+ case "js":
+ // never allow these.
+ this.denyList = Set.of("eval", "load");
+ check(lang, name, allowList, denyList);
+ break;
+ case "python":
+ // never allow these.
+ this.denyList = Set.of("eval");
Review Comment:
Added.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: pr-unsubscribe@jena.apache.org
For additional commands, e-mail: pr-help@jena.apache.org