proletarian 2023-01-23 | Slack Archive

msolli08:01:20

> so on a scale of 1-100, how bad of an idea is it to just make my “execute job” do a requiring-resolve? I’d say not so bad. The first time it’s run in the JVM process’s lifetime, it’ll take somewhere in the 10s or 100s of milliseconds, depending on how much code must be compiled during the require. After that it’s 0 milliseconds. I actually do something like that in my web route handlers without worrying too much about the speed penalty.

emccue18:01:36

I figured that the security implications of having one db table basically allowing <totally arbitrary> RCE wasn't amazing, so I put a restriction that the resolved var at least needing to have been marked with ^:background-job on its metadata

emccue18:01:09

(defn handle-job!
  [system job-type payload]
  (let [function-var (requiring-resolve (symbol job-type))]
    ;; This is to make it so that if someone inserts an arbitrary job
    ;; by accident or malice, it isn't truly arbitrary code execution
    ;; like submitting "eval" as a background job.
    (when-not (:background-job (meta function-var))
      (throw (Exception.
               (str "only functions marked as background jobs can be run. " job-type))))
    (function-var system payload)))

👌 2

msolli08:01:02

> also just a heads up on a reflection warning […] That’s weird. How’d you get a Number in there? What JVM version are you on?

emccue16:01:06

emccue16:01:53

They added a new overload to Thread/sleep that takes a duration

msolli16:01:48

Right. I’ll get a fix out shortly.

2023-01-23

Channels