GraalVM Javascript extentions

[tmmlsBE]

Hi everyone,

With this post I would like to ask a question.

I've created a small Java (8) app which executes Javascripts using GraalVM, as a replacement for the Nashorn engine.
All works well, however the latest EcmaScripts standards does have some limitations and, for example, the file system can't be accessed. This could be fixed i think using Node.js and some modules, a solution which I would like to prevent, because the scripts become depended on the installation of the Node.Js modules.

What I would like to know if (and how) it's possible to extend the Javascript Syntax, by creating some extensions?

I need some basic stuff like this ...

var f = new Folder('/some/folder/myfolder/');
if (!f.exists){
      f.create();
}

I just need a few additional basic classes (based on the ExtendScript language) like File, Folder, XML, ... etc ...
(https://www.indesignjs.de/extendscriptAPI/indesign-latest/#Folder.html)

If i'm not mistaking, using Nashorn it should be possible to create such extentions.

Thanks

[wirthi]

Hi @tmmlsBE

thanks for your question.

We do have a few additional built-ins like read(file) but most likely, this will not cover all your use-cases. See https://github.com/oracle/graaljs/blob/master/docs/user/JavaScriptCompatibility.md#additional-global-functions-in-the-js-shell

To provide implementations from Java to JavaScript, you can use our interoperability support. Have a look at https://github.com/oracle/graaljs/blob/master/docs/user/JavaInteroperability.md - in short, you can either use something like var JavaClass = Java.type("com.domain.classname"); to load Java classes into JavaScript and then use them very similar to normal JavaScript code. Or, you expose functionality wrapped in a org.graalvm.polyglot.proxy.ProxyExecutable from Java to JavaScript, to make it look like a JavaScript function as much as possible.

Using Node.js modules as you state is a possibility as well. You could use a package bundler like Browserify or Webpack to achieve that. Note that this only works if the eventloop (and other Node.js internals) are not used, and there are no dependencies on Node.js-internal packages ("fs", etc.) OR those dependencies can be substituted by the bundler. You can also load some Node.js modules directly via our org.graalvm.polyglot.Context implementation, see https://github.com/oracle/graaljs/blob/master/docs/user/NodeJSVSJavaScriptContext.md

If i'm not mistaking, using Nashorn it should be possible to create such extentions.

Note that we try to be mostly compatible with Nashorn, but ultimately, we are an independent engine. For instance, you will see best results if you use org.graalvm.polyglot.Context to load JavaScript from Java, not the ScriptEngine that Nashorn would use.

Best,
Christian

[tmmlsBE]

I found the solution. There were a few errors ... This is a working example...

Javascript

var File = Java.type("java.io.File");
var myFolder = new File("/Users/tm/Desktop/testFINAL2");
myFolder.mkdir();

Java

        String scriptContent = readScript(filePath);

        try {
            Context context = Context.newBuilder("js")
                    .allowHostAccess(HostAccess.ALL)
                    .allowAllAccess(true)
                    .build();

            Value res = context.eval("js", scriptContent);

            result = res.asString();

        } catch (Exception e) {
            e.printStackTrace();
        }

Again, many many thanks for your input.

[wirthi]

That is definitely a good solution for now. But be aware: you don't want to go into production with HostAccess.ALL and allowAllAccess(true). With that, you give your JavaScript code full access to your Java Application. This has severe security implications.

[tmmlsBE]

Thank you for your usefull feedback. What would be a better approach?

[wirthi]

Well it strongly depends on your security requirements. Is all (Java & JavaScript) code written by you and your team? Then HostAccess.ALL is fine. You might not expect attacks from that side. Although you still might want to guarded against accidental failures. Or do you use JavaScript code from the web without thoroughly reviewing it? Do you maybe even allow users to execute their own JavaScript scripts? With HostAccess.ALL and allowAllAccess, you allow JavaScript code like this to do its job:

var sys = Java.type('java.lang.System'); sys.exit(0);

A more secure option is to use HostAccess.EXPLICIT and mark the few classes that you want to grant access on with @Export. This allows you to explicitly export an API from Java to JavaScript, that (and only that) your JavaScript code can access. See https://www.graalvm.org/truffle/javadoc/org/graalvm/polyglot/HostAccess.html

Likewise, instead of allowAllAccess(true), I'd rather go with allowHostClassLookup((name) -> true) and then refine that to allow access only to Classes you think are safe to access. With java.lang.System being a counter-example that you definitely don't want to allow access to.

You will find more documentation on that e.g. at https://www.graalvm.org/22.0/reference-manual/embed-languages/

Best,
Christian

[tmmlsBE]

Again, many thanks for your very useful insights and all your help. This is very much appreciated.

For documentation purposes, I put a working example below ...

Javascript

        var File = Java.type("java.io.File");
        var myFolder = new File("/path/to/folder");
        myFolder.mkdir();

        var result = "Error";
        if(myFolder.exists){
            result = "Success";
        }
        result;

Java

        String scriptContent = readScript(filePath);

        try (Context context = Context.newBuilder()
                .allowHostAccess(HostAccess.ALL)
                .allowHostClassLookup(c -> c.equals("java.io.File"))
                .build()) {
            Value res = context.eval("js", scriptContent);
            result = res.asString();
        }catch (Exception e) {
            e.printStackTrace();
        }