Unhide setting `js.interpretation.enabled` by winterhazel · Pull Request #12605 · apache/cloudstack

winterhazel · 2026-02-06T14:35:15Z

Description

This PR proposes unhiding js.interpretation.enabled. For reference regarding why, see the discussion in #12523.

Also, the configuration was made dynamic, and some extra refactoring was performed to organize the code (JsInterpreterHelper already exists in main).

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

How Has This Been Tested?

I upgraded my environment to the new version, with the changes included, and checked the database entry for js.interpretation.enabled.

Before the changes:

MariaDB [cloud]>select*from configuration where name ="js.interpretation.enabled";
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| category | instance | component | name | value | description | default_value | updated | is_dynamic | group_id | subgroup_id | parent | display_text | kind | options | scope |
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| Hidden | DEFAULT | ManagementServer | js.interpretation.enabled | MQmVLZoL1kmmDHZR1YsoIgw0OuvMDdyTnU9y3FEUNDA= | Enable/Disable all JavaScript interpretation related functionalities to create orupdate Javascript rules. | false | 2026-01-2311:09:12 | 0 | 1 | 1 | NULL | Js interpretation enabled | NULL | NULL | 1 |
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+

In the logs:

2026-02-06 11:46:01,436 INFO [c.c.u.d.Upgrade42210to42300] (main:[]) (logid:) Updating setting 'js.interpretation.enabled' to decrypted value [true].

After the changes:

MariaDB [cloud]>select*from configuration where name ="js.interpretation.enabled";
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| category | instance | component | name | value | description | default_value | updated | is_dynamic | group_id | subgroup_id | parent | display_text | kind | options | scope |
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| System | DEFAULT | JsInterpreter | js.interpretation.enabled | true | Enable/disable all JavaScript interpretation related functionalities. | false | 2026-02-0611:45:28 | 1 | 1 | 1 | NULL | Js interpretation enabled | NULL | NULL | 1 |
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+

I attempted to create heuristic rules, flexible tags, and Quota activation rules. When the setting was disabled, I received an error informing me that js.interpretation.enabled was disabled. When the setting was enabled, I was able to create them successfully.

winterhazel · 2026-02-06T14:38:44Z

@blueorangutan package

blueorangutan · 2026-02-06T14:40:04Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-02-06T14:43:43Z

Codecov Report

❌ Patch coverage is 3.63636% with 53 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.00%. Comparing base (e2d18c0) to head (2a2058a).
⚠️ Report is 16 commits behind head on main.

Files with missing lines	Patch %	Lines
...ava/com/cloud/upgrade/dao/Upgrade42210to42300.java	0.00%	32 Missing ⚠️
.../cloudstack/jsinterpreter/JsInterpreterHelper.java	15.38%	11 Missing ⚠️
...ain/java/com/cloud/storage/StorageManagerImpl.java	0.00%	4 Missing ⚠️
...in/java/com/cloud/server/ManagementServerImpl.java	0.00%	3 Missing ⚠️
...udstack/api/response/QuotaResponseBuilderImpl.java	0.00%	2 Missing ⚠️
...n/java/com/cloud/resource/ResourceManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #12605 +/- ##
============================================
- Coverage 18.00% 18.00% -0.01% - Complexity 16464 16465 +1 
============================================
Files 5977 5976 -1 Lines 537726 537801 +75 Branches 66026 66039 +13 ============================================
+ Hits 96839 96840 +1 - Misses 429968 430039 +71 - Partials 10919 10922 +3

Flag	Coverage Δ
uitests	`3.52% <ø> (ø)`
unittests	`19.17% <3.63%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2026-02-06T15:38:42Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16729

DaanHoogland · 2026-02-09T08:28:19Z

@blueorangutan test

blueorangutan · 2026-02-09T08:30:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-02-09T08:57:10Z

[SF] Trillian Build Failed (tid-15416)

winterhazel · 2026-02-09T14:46:08Z

@blueorangutan package

blueorangutan · 2026-02-09T15:14:05Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-09T16:26:42Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16762

DaanHoogland · 2026-02-10T09:17:18Z

@blueorangutan test

blueorangutan · 2026-02-10T09:18:04Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

DaanHoogland

clgtm

blueorangutan · 2026-02-10T09:44:45Z

[SF] Trillian Build Failed (tid-15426)

Copilot

Pull request overview

This PR unhides the js.interpretation.enabled configuration setting, moving it from the "Hidden" category to the "System" category, and makes it dynamic so it can be changed without restarting the management server. This addresses issue #12523 where the management server would hang during startup when this setting was enabled. The PR refactors the JavaScript interpretation validation logic by introducing a new JsInterpreterHelper class that centralizes the configuration and validation logic.

Changes:

Introduces JsInterpreterHelper class to centralize JS interpretation configuration and validation
Moves js.interpretation.enabled from ManagementService to JsInterpreterHelper and changes it from "Hidden" to "System" category
Makes the configuration dynamic to allow runtime changes
Migrates all validation calls from ManagementService.checkJsInterpretationAllowedIfNeededForParameterValue() to JsInterpreterHelper.ensureInterpreterEnabledIfParameterProvided()
Adds database upgrade script to unhide and decrypt the existing configuration value

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server/src/main/java/org/apache/cloudstack/jsinterpreter/JsInterpreterHelper.java	New helper class that implements Configurable interface and provides the JS_INTERPRETATION_ENABLED ConfigKey and validation method
server/src/main/java/com/cloud/storage/StorageManagerImpl.java	Updated to inject and use JsInterpreterHelper for validating storage pool and secondary storage selector operations
server/src/main/java/com/cloud/server/ManagementServerImpl.java	Removed old ConfigKey definition, jsInterpretationEnabled field, and validation method; unconditionally registers CreateSecondaryStorageSelectorCmd and UpdateSecondaryStorageSelectorCmd
server/src/main/java/com/cloud/resource/ResourceManagerImpl.java	Updated to inject and use JsInterpreterHelper for validating host update operations
plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java	Removed jsInterpretationEnabled field and isJsInterpretationEnabled() method
plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java	Removed isJsInterpretationEnabled() method from interface
plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java	Updated to inject and use JsInterpreterHelper for validating quota tariff operations
engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java	Adds database migration to unhide and decrypt the js.interpretation.enabled configuration setting
api/src/main/java/com/cloud/server/ManagementService.java	Removed JsInterpretationEnabled ConfigKey and checkJsInterpretationAllowedIfNeededForParameterValue() method

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

winterhazel · 2026-02-19T17:35:45Z

@winterhazel the mgmt service failed to start , can you check ? the simulator CI tests failed too

@weizhouapache should be fixed now

blueorangutan · 2026-02-19T17:36:04Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-19T18:54:23Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16886

sureshanaparti · 2026-02-20T06:03:16Z

@blueorangutan test

blueorangutan · 2026-02-20T06:04:03Z

@sureshanaparti a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-02-20T21:20:21Z

[SF] Trillian test result (tid-15503)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 52161 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12605-t15503-kvm-ol8.zip
Smoke tests completed. 140 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_LoginApiDomain	`Error`	7.20	test_accounts.py

winterhazel · 2026-04-02T15:39:33Z

@blueorangutan package

blueorangutan · 2026-04-02T15:40:05Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-04-02T16:31:55Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17345

bernardodemarco

lgtm, manually tested in a local env:

Before

MariaDB [cloud]> select * from configuration where name = "js.interpretation.enabled";
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| category | instance | component | name | value | description | default_value | updated | is_dynamic | group_id | subgroup_id | parent | display_text | kind | options | scope |
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| Hidden | DEFAULT | ManagementServer | js.interpretation.enabled | 8M83R8t/pmuZGxpxDoQJlqvOiZHVcYFa0hBJilzKqA/T | Enable/Disable all JavaScript interpretation related functionalities to create or update Javascript rules. | false | 2026-01-08 18:09:46 | 0 | 1 | 1 | NULL | Js interpretation enabled | NULL | NULL | 1 |
+----------+----------+------------------+---------------------------+----------------------------------------------+------------------------------------------------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
1 row in set (0.001 sec)

After

MariaDB [cloud]> select * from configuration where name = "js.interpretation.enabled";
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| category | instance | component | name | value | description | default_value | updated | is_dynamic | group_id | subgroup_id | parent | display_text | kind | options | scope |
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
| System | DEFAULT | JsInterpreter | js.interpretation.enabled | false | Enable/disable all JavaScript interpretation related functionalities. | false | 2026-04-09 20:53:32 | 1 | 1 | 1 | NULL | Js interpretation enabled | NULL | NULL | 1 |
+----------+----------+---------------+---------------------------+-------+-----------------------------------------------------------------------+---------------+---------------------+------------+----------+-------------+--------+---------------------------+------+---------+-------+
1 row in set (0.001 sec)

Management Server logs

> grep 'Updating setting' /var/log/cloudstack/management/management-server.log
2026-04-09 20:49:52,904 INFO [c.c.u.d.Upgrade42210to42300] (main:[]) (logid:) Updating setting 'js.interpretation.enabled' to decrypted value [false], and category 'System', component 'JsInterpreter', and is_dynamic '1'.

@winterhazel, thanks for the PR. By the way, IMHO, hiding js.interpretation.enabled and changing its value to be encrypted was completely inappropriate. There are no known vulnerabilities in the ACS JS interpreter. We cannot simply hide a feature from the platform just because it has had a known vulnerability or because vulnerabilities could potentially be discovered in the future. If we follow this line of thinking, would we hide all ACS features by default?

winterhazel · 2026-04-10T01:42:32Z

@bernardodemarco see #12523. This change was not appropriately discussed while addressing the vulnerability that prompted the introduction of the setting.

winterhazel · 2026-04-10T01:42:55Z

@DaanHoogland could we run the CI here one last time? Edit: noticed a grammar mistake

winterhazel · 2026-04-10T01:48:36Z

@blueorangutan package

blueorangutan · 2026-04-10T01:50:04Z

@winterhazel a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-04-10T02:28:30Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17430

DaanHoogland · 2026-04-10T08:20:51Z

@blueorangutan test

blueorangutan · 2026-04-10T08:22:03Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-04-10T23:07:55Z

[SF] Trillian test result (tid-15850)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 50155 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12605-t15850-kvm-ol8.zip
Smoke tests completed. 151 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

boring-cyborgBot added component:api component:management-server component:quota component:storage labels Feb 6, 2026

winterhazel mentioned this pull request Feb 6, 2026
Management server hangs when js.interpretation.enabled=true #12523
Open

winterhazel changed the title ~~Unhide setting 'js.interpretation.enabled'~~Unhide setting js.interpretation.enabledFeb 6, 2026

sureshanaparti reviewed Feb 9, 2026
View reviewed changes

Comment threadengine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java Outdated

sureshanaparti requested review from DaanHoogland, abh1sar and shwstppr February 9, 2026 10:38

DaanHoogland approved these changes Feb 10, 2026
View reviewed changes

DaanHoogland added the status:needs-testing label Feb 10, 2026

winterhazel mentioned this pull request Feb 11, 2026
Fix injection of preset variables into the JS interpreter #12515
Merged
12 tasks

weizhouapache requested a review from Copilot February 16, 2026 11:58

Copilotstarted reviewing on behalf of weizhouapache February 16, 2026 11:58 View session

CopilotAI reviewed Feb 16, 2026
View reviewed changes

Comment threadengine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java Outdated
Comment threadengine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java Outdated

DaanHoogland added this to the 4.20.3 milestone Feb 16, 2026

winterhazel modified the milestones: 4.20.3, 4.23.0 Mar 25, 2026

Unhide setting 'js.interpretation.enabled'
63c708a

winterhazel force-pushed the unhide-js-interpretation-enabled branch from 9343086 to 63c708aCompare April 2, 2026 15:33

boring-cyborgBot added the component:integration label Apr 2, 2026

winterhazel changed the base branch from 4.20 to mainApril 2, 2026 15:36

winterhazel removed the component:integration label Apr 2, 2026

bernardodemarco approved these changes Apr 9, 2026
View reviewed changes

bernardodemarco added status:ready-for-merge and removed status:needs-testing labels Apr 9, 2026

Fix grammar mistake
2a2058a

winterhazel merged commit 9f57a4d into apache:mainApr 11, 2026
24 of 28 checks passed

weizhouapache linked an issue May 19, 2026 that may be closed by this pull request
Management server hangs when js.interpretation.enabled=true #12523
Open

Uh oh!

Conversation

winterhazel commented Feb 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

How Has This Been Tested?

Uh oh!

winterhazel commented Feb 6, 2026

Uh oh!

blueorangutan commented Feb 6, 2026

Uh oh!

codecovBot commented Feb 6, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Feb 6, 2026

Uh oh!

DaanHoogland commented Feb 9, 2026

Uh oh!

blueorangutan commented Feb 9, 2026

Uh oh!

blueorangutan commented Feb 9, 2026

Uh oh!

Uh oh!

winterhazel commented Feb 9, 2026

Uh oh!

blueorangutan commented Feb 9, 2026

Uh oh!

blueorangutan commented Feb 9, 2026

Uh oh!

DaanHoogland commented Feb 10, 2026

Uh oh!

blueorangutan commented Feb 10, 2026

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Feb 10, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

winterhazel commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

blueorangutan commented Feb 19, 2026

Uh oh!

sureshanaparti commented Feb 20, 2026

Uh oh!

blueorangutan commented Feb 20, 2026

Uh oh!

blueorangutan commented Feb 20, 2026

Uh oh!

winterhazel commented Apr 2, 2026

Uh oh!

blueorangutan commented Apr 2, 2026

Uh oh!

blueorangutan commented Apr 2, 2026

Uh oh!

bernardodemarco left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

winterhazel commented Apr 10, 2026

Uh oh!

winterhazel commented Apr 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

winterhazel commented Apr 10, 2026

Uh oh!

blueorangutan commented Apr 10, 2026

Uh oh!

winterhazel commented Feb 6, 2026•
edited
Loading

codecovBot commented Feb 6, 2026•
edited
Loading

bernardodemarco left a comment •
edited
Loading

winterhazel commented Apr 10, 2026•
edited
Loading