SPLWare / SPLWare/esProc

[建议]esProc项目拆分成多模块

Open
#36 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
4.7k
Forks
364
PR merge metrics
No merged PRs in 30d

Description

Nop低代码平台中包含了一个开源的中国式报表引擎NopReport。我在NopReport中集成了集算器的功能,可以使用SPL为NopReport提供数据。介绍视频 https://www.bilibili.com/video/BV1Km4y1m7y2/。在集成SPL的过程中,我感觉有一些可以改进的地方:

  1. SPL的设计器可以和运行时分开,这样更容易升级到高版本JDK上,也便于集成到Quarkus等框架中,使用GraalVM技术编译为exe。

  2. SPL的配置文件可以按照可逆计算原理进行改造,这样esProcFunctions_zh.xml这样的配置可以内置在jar包中,但是我们需要增强的时候,可以采用如下方式进行扩展

<funcs x:extends="raw:/config/esProcFunctions_zh.xml">
   这里只写扩展配置,可以覆盖系统内置配置
</funcs> 

具体原理可以参见我的文章 XDSL:通用的领域特定语言设计

  1. SPL可以将编译和运行分开。这样编译得到某种AST语法树之后,可以增加一些语义方面的限制和校验,比如限制文件路径必须符合某种模式等。或者在Context上增加一个ResourceLoader机制,把文件获取完全隔离到某个用户可定制的接口中,而不是直接在home目录下拼接子目录。目前的代码实现似乎是有安全漏洞的,通过../../../这种相对路径似乎可以突破目录限制访问到外部目录。

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by mapping how the SPL designer, runtime, compiler, Context, and esProcFunctions_zh.xml are currently connected. Review the configuration-loading and file-path handling around the home directory, especially the reported ../../../ traversal concern. Done would require an agreed module boundary and design for separable compilation, runtime, configuration extension, and resource loading; the issue does not define an implementation scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, build-system, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.