Security considerations

[RafaeLeal]

I'm considering using gojq as a library, allowing users to transform data with it. I'm trying to understand the security implications, so I searched first at jq and found this issue, and I'm thinking about how this translate to gojq, especially things like include and import to read arbitrary files, can we disable those while using it as a library?

[itchyny]

When using gojq library, modules are disabled by default. Use gojq.WithModuleLoader to enable include and import. Also, accessing environment variables (env, $ENV) yields empty object. Use gojq.WithEnvironLoader to customize the variable. Note that jq language is Turing-complete, user can submit something like repeat(0), range(infinite), and def f: f; f. Use code.RunWithContext to limit the execution time.