Skip to content

Replace mathjs in actor-memory-expression with a minimal expression evaluator #695

Description

@B4nan

mathjs is by far the heaviest runtime dependency in this repo, and @apify/actor-memory-expression uses a small slice of it: arithmetic, comparisons, ternaries and compareText over user-supplied memory expressions like input.dataOutput == 'full detail' ? 1024 : 512.

A small expression parser (jsep-style AST plus a whitelisted evaluator) could replace it and shrink the install dramatically. The catch, and the reason this should not ride the v3 stack: these expressions are user-supplied and evaluated on the platform, so this is security-sensitive surface. The current code carefully builds a locked-down mathjs instance (disabled evaluate/parse/compile per the mathjs security guide, see packages/actor-memory-expression/src/memory_calculator.ts), and a replacement needs the same care plus testing against the real expression corpus from apify-core before it ships.

Suggested approach:

  • collect the expression corpus from production (or at least the test fixtures in core) to pin down the actually used grammar
  • implement a minimal parser/evaluator for that grammar with an explicit operator and function whitelist, no member access beyond the provided variables
  • fuzz it against the mathjs implementation for equal results and equal rejections
  • release as a major of @apify/actor-memory-expression

Until then the locked-down mathjs setup stays.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    t-toolingIssues with this label are in the ownership of the tooling team.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions