Is this intentional or by accident?

[stephan-ansems]

First of all I want to thank the contributors for maintaining this awesome piece of code. Truly a monumental achievement.

I do have some trouble getting into this 'Javet way of thinking' that is mentioned somewhere in the documentation. Especially when it comes to interacting between the javascript environment and java.

When i use the global object to 'inject' a Java-Object I need some of these to remain unchanged after execution of the script, while others are there to be changed.

I've found out the following:

// These objects receive the deserialized json data from a POST method onsome @RestContorller
Map<String,Object> jsonObjectA = ...;
Map<String,Object> jsonObjectB = ...;

try( engine = pool.getEngine() ) {
  converter = new JavetProxyConverter();
  runtime = engine.getV8Runtime();

  // Disenable proxy map (which i interpret as 'make variables read-only')
  converter.getConfig().setProxyMapEnabled(false);
  runtime.setConverter(converter);

  // Insert the object
  runtime.getGlobalObject().set("doesNotChange", jsonObjectA);

  // Enable proxy map (which i interpret as 'make variables write-also')
  converter.getConfig().setProxyMapEnabled(true);
  runtime.setConverter(converter);

  runtime.getGlobalObject().set("doesChange", jsonObjectB);

  // execute some code 
  // ...etc...
} 

What i found is that indeed changes made to the doesNotChange object in the script will not propagate through to the jsonObjectA but changes made to the doesChange do propegate to jsonObjectB.

Is this functionality actually intended like this?

[caoccao]

Nice finding! Yes, this is by design.

In JavetObjectConverter (the default converter), a Java Map is converted to a JS Object and there is no linkage between them afterwards. This is to ensure the guest JS code cannot jailbreak to the Java host environment. One of the principles that Javet holds is Security. So the default settings for V8 mode is solidly secure.

The config in JavetProxyConverter only takes effects when the actual conversion takes place. The linkage between the Java object and JS proxy object is permanently set regardless of new changes to the config.

I believe this behavior gives the host application fine-grained control over every conversion. Actually, the advanced usage of the object conversion is to ignore the built-in converter. Application may create all kinds of converters for converting Java objects to V8Values. Javet API accepts V8Value without calling the built-in converter. So application can do whatever it wants to do without side effects.

Hope this makes sense and please let me know if you have any questions.

Thank you for acknowledging our work.

[stephan-ansems]

Excellent! This should definitely go in the documentation. ;-)

[caoccao]

I thought that was obvious. Well, obviously that is not obvious. The doc has been enhanced by this commit.