wip

CHANGELOG.md

@@ -15,6 +15,7 @@ SCI is used in [babashka](https://github.com/babashka/babashka),
 - Fix [#926](https://github.com/babashka/sci/issues/926): Support `add-watch` on vars in CLJS
 - Support `aset` on primitive array using reflection
 - Fix [#928](https://github.com/babashka/sci/issues/928): record constructor supports optional meta + ext map
+- Fix [#934](https://github.com/babashka/sci/issues/934): `:allow` may contain namespaced symbols
 
 ## 0.8.43 (2024-08-06)
 

src/sci/impl/resolve.cljc

@@ -20,13 +20,15 @@
             :sci.impl/op :resolve-sym
             :sci.impl/idx idx))))
 
-(defn check-permission! [ctx sym [check-sym  v]]
+(defn check-permission! [ctx sym kv]
   (or (identical? utils/allowed-loop sym)
       (identical? utils/allowed-recur sym)
-      (let [check-sym (strip-core-ns check-sym)
+      (let [check-sym (strip-core-ns sym)
             allow (:allow ctx)]
-        (when-not (if allow (or (and (utils/var? v) (not (:sci/built-in (meta v))))
-                                (contains? allow check-sym))
+        (when-not (if allow
+                    (let [[_ v] kv]
+                      (or (and (utils/var? v) (not (:sci/built-in (meta v))))
+                          (contains? allow check-sym)))
                       true)
           (throw-error-with-location (str sym " is not allowed!") sym))
         (let [deny (:deny ctx)]

test/sci/core_test.cljc

@@ -469,6 +469,8 @@
     (is (= 3 ((tu/eval* "(fn [x] (if (> x 1) (inc x)))" {:allow '[fn fn* if > inc]}) 2))))
   (is (tu/eval* (str (list `#(inc %) 10)) {:allow '[fn* inc]}))
   (is (tu/eval* (str (list `#(let [x %] x) 10)) {:allow '[fn* let let*]}))
+  (is (= [2 3 4] (sci/eval-string "(impl/mapv inc [1 2 3])" {:allow '[impl/mapv inc]
+                                                             :namespaces {'impl {'mapv mapv}}})))
   (is (thrown-with-msg? #?(:clj Exception :cljs js/Error)
                         #"allowed"
                         (tu/eval* "(loop [] (recur))" {:deny '[loop*]})))
@@ -481,6 +483,7 @@
   (is (thrown-with-msg? #?(:clj Exception :cljs js/Error)
                         #"allowed"
                         (tu/eval* "(clojure.core/inc 1)" {:deny '[clojure.core/inc]})))
+
   (testing "for/doseq are macroexpanded properly"
     (is (= 'loop* (first (tu/eval* "(macroexpand '(doseq [i [1 2 3]] nil))" {}))))
     (is (= 'let*