A DynamicString is a string that can contain expressions.

Basically, a dynamic string looks like this "interpreter:expression". There a many different interpreters available, e.g. "js:3*3" would calculate the product with a javascript interpreter, "placeholder:${name}" would replace the term "${name}" with the value of a variable called "name" (depending on context, obviously), or "s:Hello" is a "static" string which just uses everything after the colon, thereby providing a simple way to effectively escape further evaluation.

DynamicStrings are useful in situations where usually a normal string is used, but in certain cases an evaluation is desired. E.g., EM/OS uses many DynamicStrings in configuration properties.

The syntax for the "interpreter" part is "id%actor@locator#session". The "id" is mandatory and names the type of interpreter, e.g.:

The other parts, i.e. "%actor", "@locator", and "#session" are optional. "actor" is the name of an actor in case credentials are required to perform an operation, like e.g. sending a REST request. "locator" defines where to execute the operation, e.g. a "bash:" command can be executed locally, or via ssh at some remote server. Finally, "session" denotes an execution session, e.g. a sequence of "bash:" commands executed remotely can share a session and thereby use environment variables within it.

Please be aware that DynamicStrings are an enormously powerful instrument and can easily be abused. Like code, SQL or command shell access, they have to be treated as security critical.

Also, the locations where they are used become likewise security relevant. It is e.g. an absolute NoGo to pass unchecked, non sanitised values via the user interface into DynamicStrings.