[jena-site] branch main updated: Allow list

[andy]

This is an automated email from the ASF dual-hosted git repository.

andy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/jena-site.git


The following commit(s) were added to refs/heads/main by this push:
     new 2050bfbc0 Allow list
2050bfbc0 is described below

commit 2050bfbc0e4c9f4533909a5537faec2d6b5a3598
Author: Andy Seaborne <a...@apache.org>
AuthorDate: Sat Jul 8 22:09:07 2023 +0100

    Allow list
---
 source/documentation/query/javascript-functions.md | 31 +++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/source/documentation/query/javascript-functions.md 
b/source/documentation/query/javascript-functions.md
index 9cca68680..5773cccd8 100644
--- a/source/documentation/query/javascript-functions.md
+++ b/source/documentation/query/javascript-functions.md
@@ -69,6 +69,29 @@ JavaScript functions can also be set from a string directly 
from within Java usi
 may provide a vector for arbitrary code execution.  Therefore it is 
recommended that this feature remain disabled for
 any publicly accessible deployment that utilises the ARQ query engine.
 
+## Identifying callable functions
+
+The context setting ""http://jena.apache.org/ARQ#scriptAllowList"; is used to
+provide a comma-separated list of function names, which are the local part of
+the URI, that are allowed to be called
+as custom script functions.
+
+This can be written as `arq:scriptAllowList` for commands and Fuseki 
configuration files.
+It is the java constant `ARQ.symCustomFunctionScriptAllowList`
+
+    sparql --set arq:js-library=SomeFile.js \
+           --set arq:scriptAllowList=toCamelCase,anotherFunction
+           --data ... --query ...
+
+and a query of:
+
+    PREFIX js: <http://jena.apache.org/ARQ/jsFunction#>
+
+    SELECT ?input (js:toCamelCase(?input) AS ?X)
+    {
+        VALUES ?input { "some woRDs to PROCESS" }
+    }
+
 ## Using JavaScript functions
 
 SPARQL functions implemented in JavaScript are automatically called when a
@@ -155,7 +178,9 @@ The context setting can be provided on the command line 
starting the
 server, for example:
 
     export JVM_ARGS=-Djena:scripting=true
-    fuseki --set arq:js-library=functions.js --mem /ds
+    fuseki --set arq:js-library=functions.js \
+           --set arq:scriptAllowList=toCamelCase \                             
                
+           --mem /ds
 
 or it can be specified in the server configuration file `config.ttl`:
 
@@ -171,6 +196,10 @@ or it can be specified in the server configuration file 
`config.ttl`:
              ja:cxtName "arq:js-library" ;
              ja:cxtValue "/filepath/functions.js"
         ] ;
+        ja:context [
+             ja:cxtName "arq:scriptAllowList" ;
+             ja:cxtValue "toCamelCase"
+        ] ;
     .
 
     <#service> rdf:type fuseki:Service;