Rhino: Cannot modify a property of a sealed object

[timztroup]

The JavaScript policies we use in our apiproxies depend on several third party JavaScript libraries e.g. AJV

When we include such third party libraries using the IncludeURL tag:

<IncludeURL>jsc://ajv.min.js</IncludeURL>

We see the following error when the JavaScript policy is invoked:

{
 "fault": {
 "faultstring": "Execution of JS-ExtractVariable-Validation failed with error: Javascript runtime error: \"Cannot modify a property of a sealed object: Ajv. (JS_ExtractVariable_Validation_js#36)\"",
 "detail": {
 "errorcode": "steps.javascript.ScriptExecutionFailed"
 }
 }
}

This seems to be caused by the following defects:

https://github.com/mozilla/rhino/issues/377

https://github.com/mozilla/rhino/pull/378

These defects are fixed in Rhino 1.7.8 and we are running Apigee Edge for Private Cloud 19.01 which includes rhino-1.7.9.jar.

We suspect that when apigee invokes Rhino it is not passing passing sealed = false to initStandardObjects(ScriptableObject scope, boolean sealed).

How can we work round this issue without modifying third party code as these libraries are mission critical to our use case.

[timztroup]

Note that this issue is not specific to AJV. We have seen this error generated when including several other thirdparty JavaScript libraries e.g. JSONPath

[dchiesa1]

Hi Tim, can you show me the code at and around line 36 of JS_ExtractVariable_Validation.js ?

I'm trying to understand the exact error scenario. Is that just instantiating an Ajv object?

Do you have a small test case that reproduces the problem? do you know What sealed objects does Ajv modify? and how? Maybe we can just extract that part to explore this.

---
Seems like you want AJV for JSON Schema validation.

As a workaround I can suggest:

• This Java callout.
• Packaging your code into a hosted target and using AJV there.

We have an open feature request to provide a built-in policy for JSON Schema Validation. I don't have an estimated delivery date for that feature.

[timztroup]

In order to replicate all you would need is a simple JavaScript file that does not even attempt to instantiate AJV or make any reference to it at all but make sure to reference AJV via an include in the JavaScript policy XML.

<IncludeURL>jsc://ajv.min.js</IncludeURL>

[dchiesa1]

oh I get that. I meant, a smaller simpler workaround, without an external dependency.

I'll figure it out.

[timztroup]

We have had some success using the "policify" project:

https://github.com/orangewise/policify

"Bundle node dependencies and use them in Apigee Edge javascript policies. Built upon the excellent Browserify project."

I don't quite understand why browser friendly JavaScript packages would need this extra wrapper in order to run in rhino on apigee. Can anyone illuminate?

IS our suspicion that when apigee invokes Rhino it is not passing passing sealed = false to initStandardObjects(ScriptableObject scope, boolean sealed). correct? If this was modified in apigee would it fix our issue and thusly mean we do not need to use policify?