Przeglądaj źródła

chore: disallow user idents from clobbering internal idents

If users can clobber internal idents it would create bugs and possibly
security issues for internal idents associated with security.
Also updated docstrings of related fn
Gabriel Horner 6 miesięcy temu
rodzic
commit
90dbdd6cdc
1 zmienionych plików z 4 dodań i 2 usunięć
  1. 4 2
      deps/db/src/logseq/db/frontend/db_ident.cljc

+ 4 - 2
deps/db/src/logseq/db/frontend/db_ident.cljc

@@ -56,18 +56,20 @@
                      (str id)))
          id)))))
 
-;; TODO: db ident should obey clojure's rules for keywords
 (defn create-db-ident-from-name
   "Creates a :db/ident for a class or property by sanitizing the given name.
+  The created ident should obey clojure's rules for keywords.
 
    NOTE: Only use this when creating a db-ident for a new class/property. Using
    this in read-only contexts like querying can result in db-ident conflicts"
   [user-namespace name-string]
   {:pre [(or (keyword? user-namespace) (string? user-namespace)) (string? name-string)]}
+  (assert (not (re-find #"^(logseq|block)(\.|$)" (name user-namespace)))
+          "New ident is not allowed to use an internal namespace")
   (if #?(:org.babashka/nbb (some? js/process)
          :cljs (exists? js/process)
          :default false)
-    ;; So that we don't have to change :user.{property|class} in our tests
+    ;; Used for contexts where we want repeatable idents e.g. tests and CLIs
     (keyword user-namespace (-> name-string (string/replace #"[/()]|\s+" "-") (string/replace-first #"^(\d)" "NUM-$1")))
     (keyword user-namespace
              (str