mathjs is by far the heaviest runtime dependency in this repo, and @apify/actor-memory-expression uses a small slice of it: arithmetic, comparisons, ternaries and compareText over user-supplied memory expressions like input.dataOutput == 'full detail' ? 1024 : 512.
A small expression parser (jsep-style AST plus a whitelisted evaluator) could replace it and shrink the install dramatically. The catch, and the reason this should not ride the v3 stack: these expressions are user-supplied and evaluated on the platform, so this is security-sensitive surface. The current code carefully builds a locked-down mathjs instance (disabled evaluate/parse/compile per the mathjs security guide, see packages/actor-memory-expression/src/memory_calculator.ts), and a replacement needs the same care plus testing against the real expression corpus from apify-core before it ships.
Suggested approach:
- collect the expression corpus from production (or at least the test fixtures in core) to pin down the actually used grammar
- implement a minimal parser/evaluator for that grammar with an explicit operator and function whitelist, no member access beyond the provided variables
- fuzz it against the mathjs implementation for equal results and equal rejections
- release as a major of
@apify/actor-memory-expression
Until then the locked-down mathjs setup stays.
mathjsis by far the heaviest runtime dependency in this repo, and@apify/actor-memory-expressionuses a small slice of it: arithmetic, comparisons, ternaries andcompareTextover user-supplied memory expressions likeinput.dataOutput == 'full detail' ? 1024 : 512.A small expression parser (jsep-style AST plus a whitelisted evaluator) could replace it and shrink the install dramatically. The catch, and the reason this should not ride the v3 stack: these expressions are user-supplied and evaluated on the platform, so this is security-sensitive surface. The current code carefully builds a locked-down mathjs instance (disabled
evaluate/parse/compileper the mathjs security guide, seepackages/actor-memory-expression/src/memory_calculator.ts), and a replacement needs the same care plus testing against the real expression corpus from apify-core before it ships.Suggested approach:
@apify/actor-memory-expressionUntil then the locked-down mathjs setup stays.