Security implications of using JavaScript features

[zyzzyxdonta]

SHACL has some advanced features that use JavaScript and allow arbitrary JavaScript code to be executed. I implemented an example constraint component that checks ORCID checksums, the code for which can be found here. We should figure out which measures are taken to sandbox the JavaScript code (pySHACL uses pyduktape2) and prohibit code to be loaded from arbitrary places (see sh:jsLibraryURL), and what we have to take care of when implementing.

[zyzzyxdonta]

Even if the code is executed in a sandbox, "wasting compute time" (e.g. by crypto mining) could be an attack on a validator that runs in CI/CD.