mwhooker / jsonselect

Python implementation of jsonselect (http://jsonselect.org/)
ISC License
26 stars 6 forks source link

Allowing arbitrary strings #6

Closed progval closed 9 years ago

progval commented 9 years ago

I am willing to use this library to allow users (unauthenticated) to input arbitrary selectors and json data.

Is there any way they can use it to make the script use a lot of resources?

If yes, can you make it safe? Or add an option to allow only a restricted but safe subset of the selector language? If no, can you state it somewhere in the readme, so others know about it?

Thanks!

mwhooker commented 9 years ago

I don't know what the resource usage would look like in pathological cases. This is perhaps something you could limit on the OS. For example, see http://coldattic.info/shvedsky/pro/blogs/a-foo-walks-into-a-bar/posts/40

Unfortunately I'm no longer maintaining this project, since the jsonselect umbrella org seems abandoned, and there are plenty of other solutions (see https://github.com/mwhooker/jsonselect/issues/1#issuecomment-58121860). I'll make sure to update the README to reflect the current state

You can email me if you want to discuss professional services.

Thanks!