[Pulp-list] Pulp, MongoDB Scripting Engine

[Sean Myers]

On 02/01/2016 08:48 AM, Lesley Kimmel wrote:
> All;
> 
> Does Pulp have any direct need of the JavaScript execution capabilities of
> MongoDB? That is, in securing a system, could I use the 'noscripting'
> configuration option of MongoDB without breaking Pulp?

I don't think we use that functionality anywhere, with the exception of
a thing that I *just* wrote. That thing only uses server-side JS if
you're running mongo 2.4 in a soon-to-be-released beta of pulp 2.8, and
even then you can get around it by installing mongo 2.6 from software
collections.

So, assuming mongodb 2.6 or higher...
https://docs.mongodb.org/v2.6/core/server-side-javascript/

In a quick search I didn't see instances in our code where we mapReduce,
eval, or use javascript in a '$where' param to a mongo query. In my
hastily-researched-opinion, it's probably safe to run with
noscripting, but neither supported nor guaranteed to work as well as
without noscripting.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/pulp-list/attachments/20160212/08647ed2/attachment.sig>