feat: enabling safe functions in expression engine

packages/sdk/src/expression.test.ts

@@ -220,6 +220,60 @@ describe("lint expression", () => {
       error(1, 8, `"await" keyword is not supported`),
     ]);
   });
+
+  test("allow safe string methods", () => {
+    expect(
+      lintExpression({
+        expression: `title.toLowerCase()`,
+        availableVariables: new Set(["title"]),
+      })
+    ).toEqual([]);
+    expect(
+      lintExpression({
+        expression: `title.replace(" ", "-")`,
+        availableVariables: new Set(["title"]),
+      })
+    ).toEqual([]);
+    expect(
+      lintExpression({
+        expression: `title.split("-")`,
+        availableVariables: new Set(["title"]),
+      })
+    ).toEqual([]);
+  });
+
+  test("allow chained string methods", () => {
+    expect(
+      lintExpression({
+        expression: `title.toLowerCase().replace(" ", "-").split("-")`,
+        availableVariables: new Set(["title"]),
+      })
+    ).toEqual([]);
+  });
+
+  test("forbid unsafe method calls", () => {
+    expect(
+      lintExpression({
+        expression: `arr.pop()`,
+        availableVariables: new Set(["arr"]),
+      })
+    ).toEqual([error(0, 9, "Functions are not supported")]);
+    expect(
+      lintExpression({
+        expression: `obj.push(1)`,
+        availableVariables: new Set(["obj"]),
+      })
+    ).toEqual([error(0, 11, "Functions are not supported")]);
+  });
+
+  test("forbid standalone function calls", () => {
+    expect(
+      lintExpression({
+        expression: `func()`,
+        availableVariables: new Set(["func"]),
+      })
+    ).toEqual([error(0, 6, "Functions are not supported")]);
+  });
 });
 
 test("check simple literals", () => {
@@ -346,6 +400,42 @@ describe("transpile expression", () => {
     }
     expect(errorString).toEqual(`Unexpected token (1:0) in ""`);
   });
+
+  test("transpile string methods with optional chaining", () => {
+    expect(
+      transpileExpression({
+        expression: "title.toLowerCase()",
+        executable: true,
+      })
+    ).toEqual("title?.toLowerCase()");
+    expect(
+      transpileExpression({
+        expression: "user.name.replace(' ', '-')",
+        executable: true,
+      })
+    ).toEqual("user?.name?.replace(' ', '-')");
+    expect(
+      transpileExpression({
+        expression: "data.title.split('-')",
+        executable: true,
+      })
+    ).toEqual("data?.title?.split('-')");
+  });
+
+  test("transpile chained string methods with optional chaining", () => {
+    expect(
+      transpileExpression({
+        expression: "title.toLowerCase().replace(/\\s+/g, '-')",
+        executable: true,
+      })
+    ).toEqual("title?.toLowerCase()?.replace(/\\s+/g, '-')");
+    expect(
+      transpileExpression({
+        expression: "user.name.toLowerCase().replace(' ', '-').split('-')",
+        executable: true,
+      })
+    ).toEqual("user?.name?.toLowerCase()?.replace(' ', '-')?.split('-')");
+  });
 });
 
 describe("object expression transformations", () => {

packages/sdk/src/expression.ts

@@ -112,7 +112,20 @@ export const lintExpression = ({
       ThisExpression: addMessage(`"this" keyword is not supported`),
       FunctionExpression: addMessage("Functions are not supported"),
       UpdateExpression: addMessage("Increment and decrement are not supported"),
-      CallExpression: addMessage("Functions are not supported"),
+      CallExpression(node) {
+        // Check if this is a method call (MemberExpression) or standalone function call
+        if (node.callee.type === "MemberExpression") {
+          // Allow specific safe string methods
+          const allowedMethods = new Set(["toLowerCase", "replace", "split"]);
+          if (
+            node.callee.property.type === "Identifier" &&
+            allowedMethods.has(node.callee.property.name)
+          ) {
+            return;
+          }
+        }
+        addMessage("Functions are not supported")(node);
+      },
       NewExpression: addMessage("Classes are not supported"),
       SequenceExpression: addMessage(`Only single expression is supported`),
       ArrowFunctionExpression: addMessage("Functions are not supported"),