potiuk commented on PR #3966: URL: https://github.com/apache/jena/pull/3966#issuecomment-4700363949
Thanks @rvesse and @afs — exactly the input that turns a v0 into a real model. Folded your edits and answers into a 2nd draft (just pushed): - **SERVICE:** enabled-by-default, no allow-list yet, and per your concession an SSRF from an anonymous query is now `VALID` rather than disclaimed. - **FROM/FROM NAMED:** captured the dataset-impl dependency — with TDB2 they're in-dataset graph names and not fetched; only an arbitrary-URI-configured dataset reads `file:`/remote. - Added **JSON-LD `@context` remote-file fetch** as a distinct remote-read/SSRF surface (separate from XXE, which is off by default per Andy), and pulled **jena-text** (Lucene, reachable via `text:query`) into scope. - **JS/custom functions** framed as `by-design-operator-enabled` (allow-list; `eval` blocked; Java functions = operator class-path trust). - Dropped the "super-linear" framing — agreed it's inherent to spec-compliant SPARQL — and recorded the resource line as operator-tuned. - Seeded §11a with the two TDB-FAQ recurring items (memory growth; on-disk size / MVCC + compaction). - §14 is now the resolved record of your answers, with claims promoted to *(maintainer)*. Ready for a 2nd-draft read whenever — happy to adjust anything I mischaracterised. Thanks again for volunteering to own it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
