2023-01-23 proletarian | Clojure Slack Archive

proletarian

msolli 2023-01-23T08:36:20.236159Z

> so on a scale of 1-100, how bad of an idea is it to just make my “execute job” do a requiring-resolve? I’d say not so bad. The first time it’s run in the JVM process’s lifetime, it’ll take somewhere in the 10s or 100s of milliseconds, depending on how much code must be compiled during the require. After that it’s 0 milliseconds. I actually do something like that in my web route handlers without worrying too much about the speed penalty.

emccue 2023-01-23T18:35:36.588539Z

I figured that the security implications of having one db table basically allowing <totally arbitrary> RCE wasn't amazing, so I put a restriction that the resolved var at least needing to have been marked with ^:background-job on its metadata

emccue 2023-01-23T18:36:09.175489Z

(defn handle-job!
  [system job-type payload]
  (let [function-var (requiring-resolve (symbol job-type))]
    ;; This is to make it so that if someone inserts an arbitrary job
    ;; by accident or malice, it isn't truly arbitrary code execution
    ;; like submitting "eval" as a background job.
    (when-not (:background-job (meta function-var))
      (throw (Exception.
               (str "only functions marked as background jobs can be run. " job-type))))
    (function-var system payload)))

👌 1

msolli 2023-01-23T08:43:02.095559Z

> also just a heads up on a reflection warning […] That’s weird. How’d you get a Number in there? What JVM version are you on?

emccue 2023-01-23T16:52:06.988889Z

emccue 2023-01-23T16:52:53.431919Z

They added a new overload to Thread/sleep that takes a duration

msolli 2023-01-23T16:57:48.057419Z

Right. I’ll get a fix out shortly.

Clojurians Log v2

proletarian