package inputed Invoker, to make script operate url safly

Signed-off-by: YarBor <yarbor.ww@gmail.com>

cluster/router/script/instance/instances_pool.go

@@ -18,6 +18,8 @@
 package instance
 
 import (
+	"context"
+	"dubbo.apache.org/dubbo-go/v3/common"
 	"dubbo.apache.org/dubbo-go/v3/protocol"
 	"errors"
 	"strings"
@@ -55,3 +57,57 @@ func init() {
 	factory = make(map[string]ScriptInstances)
 	setInstances(`javascript`, newJsInstances())
 }
+
+// scriptInvokerPack for security
+// if script change input Invoker's url during Route() call ,
+// it will influence call Route() next time ,
+// there are no operation to recover .
+type scriptInvokerPack interface {
+	protocol.Invoker
+}
+
+type scriptInvokerPackImpl struct {
+	copiedURL *common.URL
+	invoker   protocol.Invoker
+	isRan     bool
+}
+
+func (f *scriptInvokerPackImpl) GetURL() *common.URL {
+	return f.copiedURL
+}
+
+func (f *scriptInvokerPackImpl) IsAvailable() bool {
+	if !f.isRan {
+		return true
+	} else {
+		return f.invoker.IsAvailable()
+	}
+}
+
+func (f *scriptInvokerPackImpl) Destroy() {
+	if !f.isRan {
+		panic("Destroy should not be called")
+	} else {
+		f.invoker.Destroy()
+	}
+}
+
+func (f *scriptInvokerPackImpl) Invoke(ctx context.Context, inv protocol.Invocation) protocol.Result {
+	if !f.isRan {
+		panic("Invoke should not be called")
+	} else {
+		return f.invoker.Invoke(ctx, inv)
+	}
+}
+
+func (f *scriptInvokerPackImpl) setRanMode() {
+	f.isRan = true
+}
+
+func newScriptInvokerImpl(invoker protocol.Invoker) *scriptInvokerPackImpl {
+	return &scriptInvokerPackImpl{
+		copiedURL: invoker.GetURL().Clone(),
+		invoker:   invoker,
+		isRan:     false,
+	}
+}

cluster/router/script/instance/js_instance.go

@@ -88,18 +88,26 @@ type jsInstance struct {
 
 func (i *jsInstances) RunScript(_ string, invokers []protocol.Invoker, invocation protocol.Invocation) ([]protocol.Invoker, error) {
 	pg := i.program.Load()
-	if pg == nil {
+	if pg == nil || len(invokers) == 0 {
 		return invokers, nil
 	}
 	matcher := i.insPool.Get().(*jsInstance)
-	matcher.initCallArgs(invokers, invocation)
+
+	packInvokers := make([]protocol.Invoker, 0, len(invokers))
+	for _, invoker := range invokers {
+		packInvokers = append(packInvokers, newScriptInvokerImpl(invoker))
+	}
+
+	matcher.initCallArgs(packInvokers, invocation)
 	matcher.initReplyVar()
 	scriptRes, err := matcher.runScript(i.program.Load())
 	if err != nil {
 		return nil, err
 	}
+
 	result := make([]protocol.Invoker, 0, len(scriptRes.(*goja.Object).Export().([]interface{})))
 	for _, res := range scriptRes.(*goja.Object).Export().([]interface{}) {
+		res.(*scriptInvokerPackImpl).setRanMode()
 		result = append(result, res.(protocol.Invoker))
 	}
 	return result, nil

cluster/router/script/instance/js_instance_test.go

@@ -128,8 +128,8 @@
 
 	rt_link_external_libraries(runtime)
 
 	err := runtime.Set("invokers", test_invokers)
 	err = runtime.Set("invocation", test_invocation)
 	err = runtime.Set("context", test_context)
 	if err != nil {
 		panic(err)
@@ -496,6 +496,7 @@
 	}
 	wg.Wait()
 }
+
 func TestFuncWithCompileAndRunRepeatedly(t *testing.T) {
 	pg, err := goja.Compile("routeJs", jsScriptPrefix+`(
 function route(invokers,invocation,context) {
@@ -532,35 +533,36 @@
 	}
 }
 
-func TestScriptWhitBrackets(t *testing.T) {
-	script := `__go_program_result = 
-
-(function route(invokers,invocation,context) {
-	var result = [];
-	for (var i = 0; i < invokers.length; i++) {
-		if ("127.0.0.1" === invokers[i].GetURL().Ip) {
-			if (invokers[i].GetURL().Port !== "20000"){
-				invokers[i].GetURL().Ip = "` + localIp + `"
-				invokers[i].GetURL().Port = "20004"
-				result.push(invokers[i]);
-			}
-	    }
-	}
-	return result;
-}(invokers, invocation, context));`
-	pg, err := goja.Compile("routeJs", jsScriptPrefix+script, true)
+func TestFuncArgsReadOnly(t *testing.T) {
+	script := `
+        Object.freeze(invokers);
+        Object.freeze(invocation);
+        Object.freeze(context);
+__result =
+    (function test(invokers, invocation, context) {
+        return (function route(invokers, invocation, context) {
+            var result = [];
+            for (var i = 0; i < invokers.length; i++) {
+                if ("10.30.0.218" === invokers[i].GetURL().Ip) {
+                    if (invokers[i].GetURL().Port === "20000") {
+                        result.push(invokers[i]);
+                    }
+                }
+            }
+            return result;
+        }(invokers, invocation, context));
+    }(invokers, invocation, context));
+`
+	rt := goja.New()
+	rt_init_args(rt)
+	_ = rt.Set(`__result`, nil)
+	pg, err := goja.Compile("", script, true)
 	if err != nil {
 		panic(err)
 	}
-	rt := goja.New()
-	rt_link_external_libraries(rt)
-	rt_init_args(rt)
-	re_init_res_recv(rt)
 	res, err := rt.RunProgram(pg)
 	if err != nil {
 		panic(err)
 	}
-	assert.Equal(t, 2, len(res.Export().([]interface{})))
-	assert.Equal(t, localIp, (*(res.Export().([]interface{})[0]).(*protocol.BaseInvoker)).GetURL().Ip)
-	assert.Equal(t, "20004", (*(res.Export().([]interface{})[0]).(*protocol.BaseInvoker)).GetURL().Port)
+	println(res)
 }