Fork me on GitHub
#datomic
<
2020-07-19
>
mafcocinco03:07:42

Also Noobie question: Typically where are schema creation files stored and when are they run? Is it every deployment, similar to migrations or something else? I assume running the same schema code over and over again is functionally idempotent, though I suppose it might generate duplicate, redundant data?

dregre01:07:59

> functionally idempotent I think schema datoms are just datoms, and since set semantics apply, if you assert a fact that is already in place no new fact is created; although I believe a transaction is.

mafcocinco13:07:01

ah, cool. So the only downside of running a schema update with every deploy, for example, would be the generation of a new transaction, which is relatively inexpensive.

David Pham08:07:36

Is there an notion of datalog injection? What kind of security issue would we need to think about if we accept an arbitrary valid edn data structure for performing the query?

favila13:07:14

(Assuming you are already using an end reader that doesn’t evaluate) datalog queries can contain function calls, but you can discover them syntactically

favila13:07:38

Aside from that, they can DOS your service just by being slow

favila13:07:40

Just like in sql, you should build the query in code and accept user input only as parameters

David Pham13:07:09

Security is a bit annoying. Because then you can let you user build their own queries. Oh sad thing.