Are unrestricted scripts still possible in Content Hub 4.x?

on

 

Blog logo

In one of the previous blog posts, I wrote about "Scripting, what to consider?". As you might have read the post, it is about what kinds of libraries you're allowed to link within your Content Hub Script. As from Content Hub version 3.2.2 unrestricted scripts will no longer be able to run. This means that the scripts are restricted to a list of permitted libraries.

For each script you now create, you will see in the API, that the property M.Script.Restricted is set to true. Via the user interface, you will no longer be able to create a Script that is not restricted. As a small experiment I tried to create a page via the Web Client SDK with a couple of lines I was able to create an unrestricted script within the Content Hub.

var scriptEntity = await mClient.EntityFactory.CreateAsync(scriptDefinition);
scriptEntity.SetPropertyValue("M.Script.Name", scriptName);
scriptEntity.SetPropertyValue("M.Script.Restricted", false);
scriptEntity.SetPropertyValue("M.Script.Type", "Action");
scriptEntity.SetPropertyValue("M.Script.Enabled", false);

await mClient.Entities.SaveAsync(scriptEntity);

This succeeds without any errors. So I was quite positive this actually worked. When I took a look at the Script via the API, I could see that the M.Script.Restricted property was set to false. Sitecore doesn't prevent you from creating an unrestricted script. I think that they might support this because of backwards compatibility when importing scripts from older versions.

The next thing with this experiment was to actually create a reference to a library that should not be allowed for a restricted script. I've added a link to System.Buffers.Binary as this does not fall within the allowed System.* libraries. Then I saved and build the changes. The build succeeds as you can see in the image below.

Successful build

There's only one thing remaining before we could actually use the script and that is publishing it. 

At this point, Sitecore has done its work correctly. The Content Hub doesn't allow an unrestricted script to be published. So yes, for backwards compatibility we still can create an unrestricted script, but we aren't able to run them anymore.