Question about the allow list

[blakepell]

Disclaimer: For security purposes I understand the benefit of having the whitelist in place for instantiating CLR objects and code.

Question: That said, is there an easy way to open it up to the entire framework without having to add everything into the whitelist?

Thank you for your time!

[koculu]

You can pass null whitelist to the AddNamespace method to disable whitelist.

[blakepell]

Thanks for talking that out with me, that helped me to find what I was doing wrong which was not fully qualifying my declaration. Everything works if I add System with sub folders set to true (thank you). I don't I fully understand AddNamespace. It seems like the 2nd and 3rd cases below should also opt in StringBuilder (but they throw a Constructor call on null is not defined). Is it because the StringBuilder uses things in it's implementation like char[], int, string, Array, GC, etc.?

• Works: script.AddNamespace("System", null, true);
• Doesn't work: script.AddNamespace("System.Text", null, true);
• Doesn't work: script.AddNamespace("System.Text", null, false);

JavaScript run for test:

let sb = new System.Text.StringBuilder();

[koculu]

Thanks for reporting the issue. It is resolved with the following ticket:
#30

Fixed version: https://github.com/koculu/Topaz/releases/tag/release-v1.4.0

[D1ssolve]

Are there mechanisms to dynamically load JavaScript modules?
for example faker.js

[koculu]

Technically, yes, but it’s not ideal for performance.
It’s better to use .NET libraries and expose their APIs in the Topaz Runtime.

You can check out these libraries:
https://github.com/bchavez/Bogus
https://github.com/Kuree/Faker.Net