CODEWITHSUNDEEP
marklogicmarklogic-8
Ravi
Ravi

Reputation: 1179

Marklogic excute Xquery code using java API

Is there a way to execute xquery code, using marklogic java api.. Basically I want to get the size of a given file and in xquery I could just do the following

return xdmp:binary-size(fn:doc($uri)/binary())

Is there an easy way to do this using Java API ? or can we execute random xquery code using java API ?

Upvotes: 0

Views: 838

Answers (2)

David Ennis -CleverLlamas.com
David Ennis -CleverLlamas.com

Reputation: 7770

You are probably looking for this: Execute ad-hoc code on the server- with data mapped automatically to/from MarkLogic. https://docs.marklogic.com/guide/java/resourceservices#id_47102

Take it for a test drive - looks like it suits your needs.

You also have the robust resource service extension options: https://docs.marklogic.com/guide/java/resourceservices#id_27702

My absolute favourite is this: https://docs.marklogic.com/guide/java/resourceservices#id_84134 Full module execution on MarkLogic with injected variables - with data mapped automatically to/from MarkLogic

We use this option as follows:

  • We have a wrapper function in Java.
  • It executes a main module in MarkLogic which is also a wrapper function
  • The markLogic function is a fancy invoker for any other modules. So, calling exec("a.b.c") on the java layer will actually execute function C in module B in directory A on the MarkLogic server -but the results are seamlessly available in the calling java code.

Its a bit more complex in real life(including security and per/post execution auditing), but certainly a pattern that can help you by keeping control over your xQuery/JS code and not allow injection of arbitrary code execution (because you execute only functions for which the connected user has rights to use).

Upvotes: 1

Sam Mefford
Sam Mefford

Reputation: 2475

Yes, you have the ServerEvaluationCall which enables both eval and invoke. However, they require special privileges. Eval is particularly dangerous because it opens up security risks when you send ad-hoc code from the client that might contain an injection attack.

Instead we recommend that you install and use a custom resource extension.

Upvotes: 3

Related Questions