Skip to content

Commit 17ed633

Browse files
committed
documentation was added
1 parent 3454d83 commit 17ed633

File tree

4 files changed

+117
-70
lines changed

4 files changed

+117
-70
lines changed

jamal-json/README.adoc

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -401,5 +401,3 @@ will result
401401
----
402402
@json:keys a/ = "a,b,c,d"
403403
----
404-
405-

jamal-maven-load/README.adoc

Lines changed: 51 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,18 @@
22

33
The Jamal Maven Load module contains a macro to download Java JAR files from Maven repositories during run-time and load the macro classes into the running application.
44

5-
The library's security was designed carefully to balance the ease of use and the security of the application.
6-
Without any security measures, a Jamal file could execute any Java code published online, which is not a good idea.
7-
To prevent this the Jamal installation has to be configured properly to use this module.
5+
I designed the library's security, balancing the ease of use and the application's security.
6+
Without security measures, a Jamal file could execute any Java code published online, which is not a good idea.
7+
The Jamal installation has to be adequately configured to use this module.
88
The requirements of a proper configuration are described in the section about security.
99

1010
== Macro
1111

12-
Currently, there is only one maco defined in this module.
12+
Currently, there is only one macro defined in this module.
1313

1414
=== `maven:load`
1515

16-
It loads the macros from a Maven artifact along with its dependencies, unless the `noDependencies` option is used.
16+
It loads the macros from a Maven artifact and its dependencies unless the `noDependencies` option is used.
1717

1818
This macro reads its input and interprets it as a maven coordinate set.
1919
The format has to be
@@ -25,9 +25,9 @@ The macro works in two steps:
2525

2626
1. First, it downloads the artifact JAR and all the dependencies.
2727

28-
2. It loads the macros from the JAR files (the specified one and the dependencies) using a class loader.
28+
2. Using a class loader, it loads the macros from the JAR files (the specified one and the dependencies).
2929

30-
It is possible to load only the file without the dependencies using the `noDependencies` option.
30+
Loading only the file without the dependencies is possible using the `noDependencies` option.
3131

3232
[WARNING]
3333
====
@@ -37,6 +37,7 @@ For more information, see the section about security.
3737
====
3838

3939
The behavior of the macro can be controlled using options.
40+
The options should follow the macro's name between `(` and `)` characters.
4041
The options are:
4142

4243
* `repositories` (aliases are `repository`, `repo`, `repos`) define the Maven repositories used comma separated.
@@ -50,9 +51,10 @@ The symbolic names can be
5051
- `google-maven-central-asia`
5152
+
5253
The default value is `central`.
53-
When a URL is specified it is checked against the configuration.
54-
The symbolic names are permitted by default, they can be used without configuration.
55-
For more information see the section about security.
54+
When a URL is specified, it is checked against the configuration.
55+
The symbolic names are permitted by default; they can be used without configuration.
56+
URLs must be configured in the `maven.load.repo` configuration property.
57+
For more information, see the section about security.
5658

5759
* `noDependencies` (alias is `noDeps`) says that the dependencies of the JAR should not be loaded.
5860
The default value is `false`.
@@ -62,8 +64,8 @@ already loaded.
6264

6365
* `local` can specify the location of the local Maven repository.
6466
The default value is `~/.m2/repository`.
65-
If this option is used it is checked against the configuration.
66-
For more information see the section about security.
67+
If this option is used, it is checked against the configuration.
68+
For more information, see the section about security.
6769

6870
* `exclude` can specify a comma-separated list of maven coordinates that should not be loaded.
6971
This parameter will not stop loading the "root" artifact specified in the macro input.
@@ -79,14 +81,14 @@ The macro `maven:load` reads the configuration of Jamal via an API that works on
7981

8082
=== Secure configuration
8183

82-
This macro works only if your configuration files' access control is properly set.
83-
Without that someone accessing the computer in a different account could modify the configuration and load malicious code.
84+
This macro works only if your configuration files' access control is set correctly.
85+
Without that, someone accessing the computer in a different account could modify the configuration, potentially loading malicious code.
8486

85-
The configuration must be secure meaning:
87+
The configuration must be secure, meaning:
8688

8789
* There is no configuration.
8890
In that case, nothing can be opened, so there is no security risk.
89-
However, in this case, the macro will not be able to load any JAR file.
91+
However, in this case, the macro cannot load any JAR file.
9092
OR
9193

9294
The configuration directory and the files are _SAFE_
@@ -125,31 +127,42 @@ When reading the configuration, if any of the
125127
126128
* `maven.load.repo`
127129
128-
properties point to files, these files should also be _SAFE_.
130+
properties point to files; these files should also be _SAFE_.
129131
====
130132

131133
NOTE: Securing the configuration is not a must for Jamal's other parts and functionalities, although it is a good practice.
132134
The security is only checked before reading the configuration for the `maven:load` macro.
133135

134136
Also, the `maven:load` macro uses a unique API to read the configuration.
135137
Every time the macro runs, the API rereads the files, checks the security of the configuration, and ignores the in-memory cached configuration.
136-
Also, note that while most of the macros and functionalities of Jamal read configuration via an API that consults the system properties first, environment variables second, and lastly only
138+
Also, note that while most of the macros and functionalities of Jamal read configuration via an API that consults the system properties first, environment variables second, and lastly, only
137139
the configuration files,
138140

139141
====
140142
the API used by the `maven:load` macro reads only the configuration files in the directory `~/.jamal/`.
141-
These are `~/.jamal/settings.properties` or `~/.jamal/settings.xml` and the files references by the above-mentioned properties.
143+
These are `~/.jamal/settings.properties` or `~/.jamal/settings.xml`.
144+
====
145+
146+
[NOTE]
147+
====
148+
When Jamal is executed in an interactive environment the security for a specific `maven:load` macro is checked only once.
149+
The security is checked only when the macro tries to load the classes.
150+
When the classes were loaded by the same JVM in a previous run, the security is not checked again.
151+
152+
It also means that changing the configuration to prevent the load of a macro library that was already loaded is futile.
153+
On the other hand, changing the configuration to allow the load of a macro library that failed to load due to security settings is effective.
154+
There is no need to restart the application executing Jamal.
142155
====
143156

144157
=== Configuration
145158

146159
The `maven:load` macro has to be configured for security reasons.
147160
It can only load JAR files which are explicitly allowed by the configuration.
148-
Also, the remote repositories and the local repository have to be configured unless the hardwired well-known repositories are used with the default local location.
161+
Also, the remote and local repositories must be configured unless the well-known hardwired repositories are used with the default local location.
149162

150163
The values for the property keys are
151164

152-
* comma separated list of maven coordinates + path,
165+
* comma-separated list of maven coordinates + path,
153166

154167
* absolute paths,
155168

@@ -159,13 +172,13 @@ The values for the property keys are
159172

160173
When a key points to a file, the file also has to be _SAFE_ as defined in the previous section.
161174
It has to be in the same directory as the configuration file and has to be specified by the bare name and extension but without any path.
162-
The file contains the configuration information one per line.
175+
The file contains the configuration information, one per line.
163176

164177
[NOTE]
165178
====
166179
You can use the comma-separated list in the `.properties` file.
167-
When you have too many configuration items, however, it is better to use a file.
168-
To have a readable format the file contains the list of the configuration items one per line.
180+
However, it is better to use a file when you have many configuration items.
181+
The file contains the list of configuration items, one per line.
169182
====
170183

171184
==== `maven.load.include`
@@ -178,6 +191,7 @@ Every maven coordinate has to be in the format
178191
groupId:artifactId:version
179192

180193
or
194+
181195
groupId:artifactId:version:path
182196

183197
The `groupId` cannot be a wildcard.
@@ -186,19 +200,20 @@ The path part is optional.
186200
If the `artifactId` is a wildcard, then the `version` has to be a wildcard too.
187201

188202
The path represents the path to the Jamal source.
189-
It can either be the absolute path to the Jamal text or a directory.
190-
When the value ends with a `/` it is considered a directory.
203+
It can be the absolute path to the Jamal input file or the directory containing one or more Jamal input files.
204+
If the path is a directory, `maven:load` is also permitted for all subdirectories.
205+
When the value ends with a `/`, it is considered a directory.
191206

192-
When the path is specified it is compared against the path of the Jamal source.
207+
When the path is specified, it is compared against the path of the Jamal source.
193208
The Jamal source file has to be the same or has to be in the specified directory.
194209

195-
The macro `maven:load` is used sometimes from a file included or imported by the top Jamal source directly or through other includes or imports.
196-
In this case, just as when the normal, the path of the top level Jamal file is used only.
210+
The macro `maven:load` is sometimes used from a file included or imported by the top Jamal source directly or through other includes or imports.
211+
In this case, the path of the top-level Jamal file is used only.
197212

198213
==== `maven.load.exclude`
199214

200-
The key `maven.load.exclude` can be used to exclude some maven coordinates from the list of allowed coordinates.
201-
If a coordinate is excluded, it cannot be used even if it is included in the `maven.load.include` list.
215+
The key `maven.load.exclude` can exclude some maven coordinates from the list of allowed coordinates.
216+
If a coordinate is excluded, it cannot be used even if included in the `maven.load.include` list.
202217

203218
A coordinate will also be skipped if one is present as a dependency.
204219
In this case, however, the download will not stop.
@@ -207,16 +222,18 @@ The class loading, however, may still fail if classes are missing because of the
207222
==== `maven.load.local`
208223

209224
The key `maven.load.local` can be used to specify the location of the local Maven repository.
210-
It has to be configured when the option `local` used.
211-
The values have to specify the absolute paths of the allowed directories that can be used as local repos.
225+
It has to be configured when the option `local` is used.
226+
The values have to specify the absolute paths of the allowed directories that can be used as local repositories.
212227

213228
WARNING: This is a security configuration.
214229
Specifying a location here will not change the default location.
230+
It merely lists the allowed locations.
215231

216232
==== `maven.load.repo`
217233

218234
The key `maven.load.repo` can be used to specify the list of allowed remote repositories in addition to the predefined ones.
219-
The values have to be the URLs as they appear in the `repositories` option of the `maven:load` macro.
235+
The values must be the URLs appearing in the `repositories` option of the `maven:load` macro.
220236

221237
WARNING: This is a security configuration.
222238
Specifying a URL here will not change the default repository.
239+
It merely lists the allowed repositories.

0 commit comments

Comments
 (0)