Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of gsf747@gmail.com designates
 74.125.82.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=Iy3zlJwg5x7D8Mb4Ruou8YgYRYrrZp8wSOcHF2YJ0AYBJd7N4vXekORaJR5vIEJ9cv
         uiezrzvVMCszad4V+cIyn8Y0OYsRuE/ciqmuU4KrVHAsrBuvwtZADy4+yurOTwQy+QYH
         9LOxXRSb2vI58q20IH//BqZYmwLzq0G1HDKg4=
MIME-Version: 1.0
In-Reply-To: <AANLkTi=KPXe9-zCip=KmYkBBgbM1AQLZuoiGTg8Hkbkg@mail.gmail.com>
References: <AANLkTim-jdhu=iw0EgdeswbNzO9YRGgq3DpfcWPdz20i@mail.gmail.com>
	<AANLkTintH+F5HrZcmkAH5U4jxZ3a+k7agFkQjPeTbrZN@mail.gmail.com>
	<AANLkTi=KPXe9-zCip=KmYkBBgbM1AQLZuoiGTg8Hkbkg@mail.gmail.com>
Date: Wed, 10 Nov 2010 10:36:23 -0500
Message-ID: <AANLkTi=OMycb8KZPzDdnqOS+QFYjWQHXjJGc8zB19axN@mail.gmail.com>
Subject: Re: Bad array check in _users/_design/_auth
From: Gabriel Farrell <gsf747@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Mon, Nov 8, 2010 at 11:10 AM, Zachary Zolton
<zachary.zolton@gmail.com> wrote:
> If your version of SpiderMonkey (used for the JavaScript view server)
> supports JavaScript version 1.8.5, you can simply use the
> Array.isArray() function.

Debian testing is still on 1.7, so maybe too soon to start using
Array.isArray(), as much as I'd like to.

> Otherwise, here's an article describing the difficulties of detecting
> whether an object is an array:
> http://is.gd/gQ2i4

Thanks for the article. I'm guessing the "multiple globals" issue is
the reason I need to eval(uneval(theArray)). I had at first attempted
to test with (theArray.constructor =3D=3D=3D Array), but even though this
works in the command-line js interpreter, I couldn't access the
constructor in the validate_doc_update script.

> On Fri, Nov 5, 2010 at 12:32 PM, Gabriel Farrell <g@grrawr.com> wrote:
>> In trying to figure out how to test for an array value in
>> validate_doc_update I ran across the following in
>> _users/_design/_auth:
>>
>> =C2=A0 =C2=A0if (!(newDoc.roles && (typeof newDoc.roles.length !=3D=3D '=
undefined'))) {
>> =C2=A0 =C2=A0 =C2=A0throw({forbidden: 'doc.roles must be an array'});
>> =C2=A0 =C2=A0}
>>
>> Strings also have a length method, so this is a bad test for an array.
>> Setting "roles" to a string for any user got no complaint from
>> validate_doc_update, but thereafter I could no longer perform any
>> administrative tasks in Futon, nor log in or out, and I got "An error
>> occurred getting session info: function_clause" popping up on every
>> page. Deleting the cookie allowed me to log back in and fix the doc.
>>
>> Now that I look at it, there's also an erroneous exclamation point at
>> the start of that condition.
>>
>> After a lot of trial and error I got it working with the following:
>>
>> =C2=A0 =C2=A0if (newDoc.roles && !(eval(uneval(newDoc.roles)) instanceof=
 Array)) {
>> =C2=A0 =C2=A0 =C2=A0 =C2=A0throw({forbidden: 'doc.roles must be an array=
'});
>> =C2=A0 =C2=A0}
>>
>> If there's a less-convoluted way to test for an array, I'd be happy to s=
ee it.
>>
>> Should I put this in JIRA? If so, would the component be Futon?
>>
>>
>> Gabriel
>>
>