javascript - plv8禁用eval()中的执行和准备功能

如何在评估中停用对plv8功能的访问？

create or replace function
js(src text, input json) returns json as $$
  plv8.elog(NOTICE, 'test');
  //--plv8 = null; // this would disable permanently plv8, also after another call of the function
  var evalRes = eval('var output=null; ' + src + '; output;');
  return JSON.stringify(evalRes);
$$ LANGUAGE plv8;

最佳答案

我终于找到了解决办法：

create or replace function
public.js(src text, input json) returns json as $$
  //-- select js('var a = input.test; var output = []; for(k in a) { output.push(10+a[k]); };', '{"test": [1,2,3]}'::json)
  //-- select public.js('plv8.elog(NOTICE, "yoyo");', null) // should not be possible
  plv8.elog(NOTICE, 'test');
  var evalRes = null;
  (function() {
        var plv8 = null; //-- In order to disable execute, prepare...
        evalRes = eval('var output=null; ' + src + '; output;');
  })();
  plv8.elog(NOTICE, 'test2');
  return JSON.stringify(evalRes);
$$ LANGUAGE plv8;