nickva commented on code in PR #6080:
URL: https://github.com/apache/couchdb/pull/6080#discussion_r3725847208
##########
src/mango/src/mango_native_proc.erl:
##########
@@ -95,6 +100,21 @@ handle_call({prompt, [<<"nouveau_index_doc">>, Doc]},
_From, St) ->
Else
end,
{reply, Vals, St};
+handle_call({prompt, [<<"validate_fun">>, Selector0 | _Rest]}, _From, St) ->
+ try mango_selector:normalize(Selector0) of
+ Selector ->
+ case validate_vdu(Selector) of
+ ok -> {reply, true, St};
+ Error -> {reply, {error, Error}, St}
+ end
+ catch
+ throw:{mango_error, mango_selector, {invalid_operator, Op}} ->
+ Msg = io_lib:format("invalid operator: ~p", [Op]),
+ {reply, {error, {compilation_error, Msg}}, St};
+ throw:{mango_error, mango_util, {invalid_field_name, Field}} ->
Review Comment:
Wonder if this will catch all possible mango_error errors. What about
`{mango_error, mango_selector, {bad_arg, ...}}`. Maybe we can just do
```
throw:{mango_error, _Mod, Reason} ->
Msg = io_lib:format("invalid selector: ~p", [Reason]),
{reply, {error, {compilation_error, Msg}}, St}
```
So we don't have to worry about every single corner case here
##########
src/couch_mrview/src/couch_mrview.erl:
##########
@@ -263,6 +266,27 @@ validate(Db, DDoc) ->
ok
end.
+validate_vdu(Proc, VDU0) ->
+ case VDU0 of
+ {ok, VDU} ->
+ couch_query_servers:try_compile(
+ Proc, validate_doc_update, <<"validate_doc_update">>, VDU
+ );
+ _ ->
+ ok
+ end.
+
+should_validate_vdu(#doc{body = {Props}}) ->
+ case config:get_boolean("couchdb", "validate_vdu", false) of
Review Comment:
As discussed in slack let's always validate mango VDUs to remove a footgun
from the users
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
