3

My professor wants me to write a little tutorial on how to deploy Ballerina services. So I'm trying to learn it. I'm using Version 1.2 and I'm a bit overwhelmed by the concept of taint checking and the variable types...

I'm trying to write a minimal REST-Service with an endpoint that requests json data from another api and then uses that JSON to do stuff.

What's working so far is the following:

service tutorial on new http:Listener(9090) {

    // Resource functions are invoked with the HTTP caller and the incoming request as arguments.
    resource function getName(http:Caller caller, http:Request req) {
   http:Client clientEP = new("https://api.scryfall.com/");

    var resp = clientEP->get("/cards/random");
    if (resp is http:Response) {

        var payload = resp.getJsonPayload();

        if (payload is json) {

            var result = caller->respond(<@untainted>(payload));
        } else {

            log:printError("");
        }
    } else {

        log:printError("");
    }
}

That responds with the JSON that is returned from https://api.scryfall.com/cards/random

But lets now say, that I want to access a single value from that JSON. e.G. "name". If I try to access it like this: payload["name"]

I get: invalid operation: type 'json' does not support indexing

I just figured out that it works if I create a map first like that:

map mp = <map>payload;

If I then access mp["name"] it works. BUT WHY? What is the json type good for if you still have to create a map and then cast the payload? And how would I access json inside the json? For example mp["data"][0]... invalid operation: type 'json' does not support indexing again...

And I'm still trying to understand the concept of taint checking.... do I just cast everything that is tainted to <@untainted> after checking the content? Sometimes I really do not get what the documentation is trying to tell me....

Jan-Ole Hübner
  • 114
  • 10

1 Answers1

3

I would recommend you to use Ballerina Swan Lake versions. Swan Lake versions contain enhancements to various language features. Here is a sample code that covers your use case. You can download Swan Lake Alpha2 at https://ballerina.io/

import ballerina/io;
import ballerina/http;

service tutorial on new http:Listener(9090) {
    resource function get payload() returns json|error {
        http:Client clientEP = check new ("https://api.scryfall.com/");
        json payload = <json> check clientEP -> get("/cards/random", targetType = json);

        // Processing the json payload 
        // Here the type of the `payload.name` expression is json | error
        // You can eliminate with check: it returns from this resource with this error
        json nameField = check payload.name;
        io:println(nameField);

        // You can traverse the json tree as follows
        json standardLegality = check payload.legalities.standard;
        io:println(standardLegality);

        // colors is an array 
        // The cast is necessary because `check payload.colors` gives you a json
        json colors = <json[]> check payload.colors;
        io:println(colors);

        // Responding with the complete payload recived from api.scryfall.com
        return payload;
    }
}

Taint analysis helps you to write code with no security vulnerabilities. However, we've disabled taint analysis in Swan Lake versions. If you want to enable it, you can use the option --taint-check with bal build

Sameera Jayasoma
  • 1,545
  • 8
  • 12
  • To add to Sameera's response, if you need more information on taint checking in Ballerina, check the following blog post: https://medium.com/ballerina-techblog/ballerina-taint-checking-guide-553ec9b8f153. – Anjana Fernando Feb 24 '21 at 21:46
  • Thanks for the help so far... I switched to swan lake - but all the different types, typecasts etc still confuse me... The code works fine, but I don't really understand why... or lets say: I get why this example works but I'm still lost when it gets more complex... lets say I now have a field payload.data, it contains multiple json objects. Let's now say I want to acces the first one. When I do: payload.data[0].name; - I get type 'json' does not support indexing. How the hell would that work? Kinda frustrating that i'm not geting such basic concepts... @Sameera – Jan-Ole Hübner Feb 26 '21 at 12:32
  • Got it... works with: json[] data = check payload.data; It feels wrong casting so much... would this be bad practise? – Jan-Ole Hübner Feb 26 '21 at 12:53
  • 1
    The current design requires you to do the required casts when needed. So what you suggested is correct. – Anjana Fernando Mar 01 '21 at 11:38