fix for [MNT-23158] brakes context in nested JS calls

[hi-ko]

Since the changes done for MNT-23158, contexts in a running JavaSrcript are lost during execution when interacting with Java logic (behaviors, rules, actions, web scripts, js root scope objects) which also call a JavaScript.

It no longer possible to access the context in the outer/parent script after the java execution has run the child script. The scope of the parent script will be unset from the inner execution.

e.g. running following javascript

var node = document;
var scriptResponse = customExtension.executeScript('workspace://SpacesStore/0e85ce81-6dbd-4f7d-b58f-90dd8b53e205',{document: document, test1: "foo"})
logger.log(scriptResponse); // this runs successfull without issue and returns as expected

// after the script has been run by the customExtension the active script lost context!
node = utils.getNodeFromString("workspace://SpacesStore/08395317-00ab-4e77-88fa-33f6e95224fa");
logger.log(node); // this works

logger.log(node.name) // this will fail since the context is broken

will throw:

Cannot invoke "org.mozilla.javascript.Scriptable.getParentScope()" because "obj" is null

2025-07-15T10:07:20,119 [] ERROR [repo.action.AsynchronousActionExecutionQueueImpl] [defaultAsyncAction1] Failed to execute asynchronous action: Action[ id=1bfe7caf-b012-4604-92f4-d808aa9a5029, node=workspace://SpacesStore/1bfe7caf-b012-4604-92f4-d808aa9a5029 ]: Cannot invoke "org.mozilla.javascript.Scriptable.getParentScope()" because "obj" is null
org.alfresco.scripts.ScriptException: 06150046 Failed to execute script 'workspace://SpacesStore/a287d247-50da-401e-875c-afeedbcb452e': Cannot invoke "org.mozilla.javascript.Scriptable.getParentScope()" because "obj" is null
        at org.alfresco.repo.jscript.RhinoScriptProcessor.execute(RhinoScriptProcessor.java:328) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.processor.ScriptServiceImpl.execute(ScriptServiceImpl.java:265) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.processor.ScriptServiceImpl.executeScript(ScriptServiceImpl.java:150) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
        at java.lang.reflect.Method.invoke(Method.java:569) ~[?:?]
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:343) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:196) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.alfresco.repo.security.permissions.impl.AlwaysProceedMethodInterceptor.invoke(AlwaysProceedMethodInterceptor.java:41) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:184) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:53) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:184) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:166) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:184) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:123) ~[spring-tx-6.0.14.jar:6.0.14]
        at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:391) ~[spring-tx-6.0.14.jar:6.0.14]
        at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:119) ~[spring-tx-6.0.14.jar:6.0.14]
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:184) ~[spring-aop-6.0.14.jar:6.0.14]
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:244) ~[spring-aop-6.0.14.jar:6.0.14]
        at jdk.proxy4.$Proxy203.executeScript(Unknown Source) ~[?:?]
        at org.alfresco.repo.action.executer.ScriptActionExecuter.executeImpl(ScriptActionExecuter.java:178) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.executer.ActionExecuterAbstractBase.execute(ActionExecuterAbstractBase.java:293) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.ActionServiceImpl.directActionExecution(ActionServiceImpl.java:910) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.executer.CompositeActionExecuter.executeImpl(CompositeActionExecuter.java:82) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.executer.ActionExecuterAbstractBase.execute(ActionExecuterAbstractBase.java:293) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.ActionServiceImpl.directActionExecution(ActionServiceImpl.java:910) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.ActionServiceImpl.executeActionImpl(ActionServiceImpl.java:811) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.AsynchronousActionExecutionQueueImpl$ActionExecutionWrapper$1$1.execute(AsynchronousActionExecutionQueueImpl.java:433) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:452) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:321) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.AsynchronousActionExecutionQueueImpl$ActionExecutionWrapper$1.doWork(AsynchronousActionExecutionQueueImpl.java:442) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.tenant.TenantUtil.runAsWork(TenantUtil.java:126) ~[alfresco-data-model-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.tenant.TenantUtil.runAsTenant(TenantUtil.java:95) ~[alfresco-data-model-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.tenant.TenantUtil$1.doWork(TenantUtil.java:69) ~[alfresco-data-model-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:602) ~[alfresco-data-model-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.tenant.TenantUtil.runAsUserTenant(TenantUtil.java:65) ~[alfresco-data-model-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.action.AsynchronousActionExecutionQueueImpl$ActionExecutionWrapper.run(AsynchronousActionExecutionQueueImpl.java:445) [alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
        at java.lang.Thread.run(Thread.java:840) [?:?]
Caused by: java.lang.NullPointerException: Cannot invoke "org.mozilla.javascript.Scriptable.getParentScope()" because "obj" is null
        at org.mozilla.javascript.ScriptableObject.getTopLevelScope(ScriptableObject.java:1941) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.ScriptRuntime.setBuiltinProtoAndParent(ScriptRuntime.java:4271) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.Context.newArray(Context.java:1562) ~[rhino-1.7.14.jar:1.7.14]
        at org.alfresco.repo.jscript.ValueConverter.convertValueForScript(ValueConverter.java:129) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.jscript.ScriptNode$NodeValueConverter.convertValueForScript(ScriptNode.java:3815) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.jscript.ScriptNode$NodeValueConverter.convertValueForScript(ScriptNode.java:3794) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.jscript.ScriptNode.getProperties(ScriptNode.java:1008) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.jscript.ScriptNode.getName(ScriptNode.java:400) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at jdk.internal.reflect.GeneratedMethodAccessor590.invoke(Unknown Source) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
        at java.lang.reflect.Method.invoke(Method.java:569) ~[?:?]
        at org.mozilla.javascript.MemberBox.invoke(MemberBox.java:206) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.JavaMembers.get(JavaMembers.java:95) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.NativeJavaObject.get(NativeJavaObject.java:95) ~[rhino-1.7.14.jar:1.7.14]
        at org.alfresco.repo.jscript.SandboxNativeJavaObject.get(SandboxNativeJavaObject.java:49) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.mozilla.javascript.ScriptableObject.getProperty(ScriptableObject.java:2023) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.ScriptRuntime.getObjectProp(ScriptRuntime.java:1672) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.ScriptRuntime.getObjectProp(ScriptRuntime.java:1667) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.gen.workspace___SpacesStore_a287d247_50da_401e_875c_afeedbcb452e_54._c_script_0(workspace://SpacesStore/a287d247-50da-401e-875c-afeedbcb452e:209) ~[?:?]
        at org.mozilla.javascript.gen.workspace___SpacesStore_a287d247_50da_401e_875c_afeedbcb452e_54.call(workspace://SpacesStore/a287d247-50da-401e-875c-afeedbcb452e) ~[?:?]
        at org.mozilla.javascript.ContextFactory.doTopCall(ContextFactory.java:380) ~[rhino-1.7.14.jar:1.7.14]
        at org.alfresco.repo.jscript.AlfrescoContextFactory.doTopCall(AlfrescoContextFactory.java:127) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.mozilla.javascript.ScriptRuntime.doTopCall(ScriptRuntime.java:3868) ~[rhino-1.7.14.jar:1.7.14]
        at org.mozilla.javascript.gen.workspace___SpacesStore_a287d247_50da_401e_875c_afeedbcb452e_54.call(workspace://SpacesStore/a287d247-50da-401e-875c-afeedbcb452e) ~[?:?]
        at org.mozilla.javascript.gen.workspace___SpacesStore_a287d247_50da_401e_875c_afeedbcb452e_54.exec(workspace://SpacesStore/a287d247-50da-401e-875c-afeedbcb452e) ~[?:?]
        at org.alfresco.repo.jscript.RhinoScriptProcessor.executeScriptImpl(RhinoScriptProcessor.java:589) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        at org.alfresco.repo.jscript.RhinoScriptProcessor.execute(RhinoScriptProcessor.java:324) ~[alfresco-repository-23.2.0.60.jar:23.2.0.60]
        ... 41 more

while the parent script is still running, the customExtension runs another (nested) script as hook

scriptService.executeScript(nodeRef, customModel);

but as soon the nested script finishes and the customExtension returns, the context is broken for the parent script above / the scope not only from the nested but also from the parent script is unset. This means, it's still possible to work with customExtension's return but from the next command, utils.getNodeFromString() it's no longer possible to get it's context like node.name

This is totally unexpected and should be seen as a bug and is a braking change. Nested Java<->JS interop contexts should be seen as perfectly valid due to the interaction of behaviours, rules, actions, web scripts etc.

Instead only the context of the inner script should be unset and therefor not share any context to avoid memory issues like addressed in MNT-23158.

Caused by the changes done in [MNT-23158] Scripts limits configuration and optimization #1519

[hi-ko]

OK, the only work around is to run any potential child script from the classpass not to break any parent script.
Script service only unsets the context for scripts having @param secure=true , which is set when load from the classpath ...

However, it would make more sense to initialize the scope by default, rather than allowing "secure" scripts in sharedScope to potentially brake when a nested script gets called from the dictionary by Java.

[hi-ko]

The work around to run any script from the classpath is actually not a work around because only these "secure" scripts will loose its scope once a dependent script running in the same transaction hierarchy will nullify the shared scope and therefore also for the secure parent.

The issue is understood now and the evil thing is here:

alfresco-community-repo/repository/src/main/java/org/alfresco/repo/jscript/RhinoScriptProcessor.java

Line 806 in f84a703

deleteProperty(scope, id.toString());

Which will not only delete the scope of the child script but also from any other script in the execution hierarchy sharing the context.
So If Alfresco wants to fix the memory issue MNT-23158, you need to run all scripts in a private context, not only the "insecure" ones.

We looked into your testcase:

alfresco-community-repo/repository/src/test/java/org/alfresco/repo/jscript/RhinoScriptTest.java

Line 451 in 4c05f8f

public void testScopeData()

Which is actually not testing your implementation, so what is this test for? You woud need to run a script from your own implementation like

alfresco-community-repo/repository/src/main/java/org/alfresco/service/cmr/repository/ScriptService.java

Line 191 in f84a703

public Object executeScriptString(String script, Map<String, Object> model, boolean secure)

and then you will have the same issue with even the scripts provided by Alfresco.

The only partially working but ugly work around we found so far is:

• in any java implementation running a jscript store and return the scope, so a calling script could use the provided scope object to restore any root scope or save the scope at the beginning of every custom script and be pepared to restore before accessing any root object.

example script code just to illustrate the principle:

var oldscope=utils.scope
var response=customExtension.getScriptResult(node, 'workspace://SpacesStore/0e85ce81-6dbd-4f7d-b58f-90dd8b53e205', {test1: "hello"});
// from now on all root scope objects have empty scope, so we need to restore before any usage:
utils.scope=oldscope;
node=utils.getNodeFromString(node.nodeRef);
logger.log(node.name);  // which failled before if not restoring the scope

This work around will still not cover the case that a script gets started from a folder rule or behavior caused by your own script. This means any change done in custom script could fire another script somewhere and wipe you out all the scopes of your root scope objects in the current script!

[hi-ko]

To reproduce the issue you need to run a secure javascript which fires/starts a insecure javascript.

In the following example we use a behavior script to run a secure script which starts an insecure script action from the repository:

1. create a very simple rule script ruleTestScript.js in /Data Dictionary/Scripts/

   /*** 
     This script does not need to do much
     once it has run it will also delete the shared scope from a parent execution once finished
   */
   logger.log(`## ruleTestScript.js ## file ${document.name} fired folder rule`);

2. register a simple behavior onCreateNode on cm:content by putting a new context file into classpath alfresco/extension

   <?xml version='1.0' encoding='UTF-8'?>
   <!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
   
   <beans>
       <bean id="onUpdateNodeTest"
           class="org.alfresco.repo.policy.registration.ClassPolicyRegistration"
           parent="policyRegistration">
           <property name="policyName">
               <value>{http://www.alfresco.org}onCreateNode</value>
           </property>
           <property name="className">
               <value>{http://www.alfresco.org/model/content/1.0}content</value>
           </property>
           <property name="behaviour">
               <bean class="org.alfresco.repo.jscript.ScriptBehaviour"
                   parent="scriptBehaviour">
                   <property name="location">
                       <bean class="org.alfresco.repo.jscript.ClasspathScriptLocation">
                           <constructor-arg>
                               <value>alfresco/extension/scripts/onCreateNode.js</value>
                           </constructor-arg>
                       </bean>
                   </property>
               </bean>
           </property>
       </bean>
   </beans>

3. create script onCreateNode.js in classpath alfresco/extension/scripts/ to be run as "secure" script (please replace NodeRef value for jsNode with nodeRef for the ruleTestScript.js from step 1 in your repo)

   var scriptFailed = false;
   // Have a look at the behaviour object that should have been passed
   if (behaviour == null) {
       logger.log("## The behaviour object has not been set.");
       scriptFailed = true;
   }
   // Check the name of the behaviour
   if (behaviour.name == null || behaviour.name != "onCreateNode") {
       logger.log("## The behaviour name has not been set correctly.");
       scriptFailed = true;
   } else {
       logger.log("## Behaviour name: " + behaviour.name);
   }
   // Check the arguments
   if (behaviour.args == null) {
       logger.log("## The args have not been set.");
       scriptFailed = true;
   } else {
       if (behaviour.args.length == 1) {
           var assoc = behaviour.args[0];
           if (assoc.type == "{http://www.alfresco.org/model/content/1.0}contains" && assoc.primary){
               var parent = assoc.parent;
               var child = assoc.child;
               var jsNode = utils.getNodeFromString('workspace://SpacesStore/13128d0a-b2bb-414c-a692-4c1017fe255c');
   
               if (jsNode){
                   var action = actions.create("script");
                   action.parameters["script-ref"] = jsNode.nodeRef; 
                   action.execute(child);
               }
               logger.log(`## onCreateNode.js ## BEGIN`);
               var node = utils.getNodeFromString(child.nodeRef);
               logger.log(`### found node: ${node}`);
               logger.log(`### node name: ${node.name}`);
               logger.log(`## onCreateNode.js ## END`);
           } else {
               logger.log(`##### not interested in assoc type: ${assoc.type}`);
           }
       } else {
           logger.error(`the behavior has more than one argument`);
       }
   }

4. restart alfresco to load the new behavior
5. upload a new document

onCreateNode.js will throw

org.mozilla.javascript.WrappedException: Wrapped java.lang.NullPointerException: Cannot invoke "org.mozilla.javascript.Scriptable.getParentScope()" because "obj" is null (alfresco/extension/scripts/onCreateNode.js#54)

because RhinoScriptProcessor.java deleted the shared scope when ending the insecure rule script from the repository, so the parent onCreateNode.js no longer has a scope.

Expected behavior: onCreateNode.js should keep its scope and could log node.name from node returned from utils.getNodeFromString()