Validate database names

Đang mở
  • Có gì không ổn?
#9,291 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
22/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
javascript, nodejs
Lĩnh vực
backend, database

Hướng nghiên cứu

The work sits in the LevelDB adapter, pouchdb-adapter-leveldb, at database initialisation, where the name becomes a filesystem path. The proposal is to accept only CouchDB's name regex, ^[a-z][a-z0-9_$()+/-]*$, and to add a databaseDir option to new PouchDB(name, options) joined with path.join(). Before coding, settle the breaking-change and opt-in question with maintainers, since the issue asks for discussion. Done means invalid names are rejected, the directory option works, and tests cover both.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Pasting this from a PR that got closed by the submitter without further comment:

  1. I think this is an issue worth fixing.
  2. This only really applies to non-browser environments, that currently* means the LevelDB pouchdb-adapter-leveldb adapter is affected (the -memory and -localstorage variants use in-browser and in-memory backends that are not affected. So a fix should probably live in pouchdb-adapter-leveldb.
  3. Next let’s consider what we are trying to say here: there are certain database names that should not be allowed. As usual for PouchDB, we can look at CouchDB for inspiration and CouchDB has a definition of a valid database name, it even gives a regex: ^[a-z][a-z0-9_$()+/-]*$. This regex is designed to only allow characters that are allowed as filenames on all file systems. This definition has not changed since it was first introduced in CouchDB at around (IIRC) 2007 or 2008, so I am happy to say it survived real world contact.
  4. But PouchDB-in-Node.js scenarios use the name in one additional way that differs from CouchDB: specification of database directory. By default your LevelDB databases go into ./ and you can override this with a ./data/ prefix for any name to put all databases into that subdir. This is a feature we should keep supporting, but without overloading the database name, and thus allowing file-system-traversal-relevant characters.
  5. CouchDB also allows the configuration of a database directory, but that happens in CouchDB’s configuration, not by inferring a path from the database name (there is an exception for / in db names that do create subdirs, but those never allow upwards traversal), but by having a database_dir configuration value that is set when CouchDB starts.
  6. Given all this, I suggest we do the following:
    1. inside pouchdb-adapter-leveldb during database initialisation, we only allow the regex as defined by CouchDB for valid database names.
    2. we also introduce a new option to be passed to new PouchDB(name, options) called databaseDir. The name and databaseDir are then path.join()ed before handing them to LevelDB or using them for separate cleanup operations.
    3. this is a backwards-incompatible or breaking change. We try to avoid these, but I think it could be warranted here. I could be convinced to allow a fallback with yet another option, so folks can just enable the old behaviours without a semantic port to the new system that might cause issues. I’m a bit on the fence about about it. Maybe the answer is to release the fix as opt-in in a bugfix release and then flip it to opt-out in the next major release. But please discuss.

*we’ll keep this in mind for the ongoing SQLite adapter work, cc @Realtin @AlbaHerrerias.

Ngôn ngữ chính
JavaScript
Star
17.6k
Fork
1.5k
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của apache/pouchdb

Tất cả issue của apache/pouchdb

Issue tương tự

Thêm issue về JavaScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.