plv8 disable execute and prepare function in eval()

て烟熏妆下的殇ゞ 提交于 2019-12-13 19:14:31

问题


How could I deactivate the access to plv8 functions in my eval?

create or replace function
js(src text, input json) returns json as $$
  plv8.elog(NOTICE, 'test');
  //--plv8 = null; // this would disable permanently plv8, also after another call of the function
  var evalRes = eval('var output=null; ' + src + '; output;');
  return JSON.stringify(evalRes);
$$ LANGUAGE plv8;

回答1:


I finally found the solution:

create or replace function
public.js(src text, input json) returns json as $$
  //-- select js('var a = input.test; var output = []; for(k in a) { output.push(10+a[k]); };', '{"test": [1,2,3]}'::json)
  //-- select public.js('plv8.elog(NOTICE, "yoyo");', null) // should not be possible
  plv8.elog(NOTICE, 'test');
  var evalRes = null;
  (function() {
        var plv8 = null; //-- In order to disable execute, prepare...
        evalRes = eval('var output=null; ' + src + '; output;');
  })();
  plv8.elog(NOTICE, 'test2');
  return JSON.stringify(evalRes);
$$ LANGUAGE plv8;


来源:https://stackoverflow.com/questions/30706274/plv8-disable-execute-and-prepare-function-in-eval

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!