Validate database names

オープン
  • 何か問題がありますか？
#9,291 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
22/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
javascript, nodejs
領域
backend, database

調査の方向性

The work sits in the LevelDB adapter, pouchdb-adapter-leveldb, at database initialisation, where the name becomes a filesystem path. The proposal is to accept only CouchDB's name regex, ^[a-z][a-z0-9_$()+/-]*$, and to add a databaseDir option to new PouchDB(name, options) joined with path.join(). Before coding, settle the breaking-change and opt-in question with maintainers, since the issue asks for discussion. Done means invalid names are rejected, the directory option works, and tests cover both.

索引モデルが issue の本文から書いたものです。

説明

Pasting this from a PR that got closed by the submitter without further comment:

  1. I think this is an issue worth fixing.
  2. This only really applies to non-browser environments, that currently* means the LevelDB pouchdb-adapter-leveldb adapter is affected (the -memory and -localstorage variants use in-browser and in-memory backends that are not affected. So a fix should probably live in pouchdb-adapter-leveldb.
  3. Next let’s consider what we are trying to say here: there are certain database names that should not be allowed. As usual for PouchDB, we can look at CouchDB for inspiration and CouchDB has a definition of a valid database name, it even gives a regex: ^[a-z][a-z0-9_$()+/-]*$. This regex is designed to only allow characters that are allowed as filenames on all file systems. This definition has not changed since it was first introduced in CouchDB at around (IIRC) 2007 or 2008, so I am happy to say it survived real world contact.
  4. But PouchDB-in-Node.js scenarios use the name in one additional way that differs from CouchDB: specification of database directory. By default your LevelDB databases go into ./ and you can override this with a ./data/ prefix for any name to put all databases into that subdir. This is a feature we should keep supporting, but without overloading the database name, and thus allowing file-system-traversal-relevant characters.
  5. CouchDB also allows the configuration of a database directory, but that happens in CouchDB’s configuration, not by inferring a path from the database name (there is an exception for / in db names that do create subdirs, but those never allow upwards traversal), but by having a database_dir configuration value that is set when CouchDB starts.
  6. Given all this, I suggest we do the following:
    1. inside pouchdb-adapter-leveldb during database initialisation, we only allow the regex as defined by CouchDB for valid database names.
    2. we also introduce a new option to be passed to new PouchDB(name, options) called databaseDir. The name and databaseDir are then path.join()ed before handing them to LevelDB or using them for separate cleanup operations.
    3. this is a backwards-incompatible or breaking change. We try to avoid these, but I think it could be warranted here. I could be convinced to allow a fallback with yet another option, so folks can just enable the old behaviours without a semantic port to the new system that might cause issues. I’m a bit on the fence about about it. Maybe the answer is to release the fix as opt-in in a bugfix release and then flip it to opt-out in the next major release. But please discuss.

*we’ll keep this in mind for the ongoing SQLite adapter work, cc @Realtin @AlbaHerrerias.

主要言語
JavaScript
スター
17.6k
フォーク
1.5k
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/pouchdb のほかの issue

apache/pouchdb の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。