[jira] (SOLR-16781) Remove directives from Solr

["Jan Høydahl (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SOLR-16781 ]


    Jan Høydahl deleted comment on SOLR-16781:
    ------------------------------------

was (Author: janhoy):
See SOLR-16949 for the alternative approach of detecting {{.jar}}, {{.tar}}, {{.class}}, {{.sh}} files based on file content.

A perhaps less intrusive option mentioned is to feature toggle use of {{LocalFileSystemRepository}} for the backup API.

> Remove <lib> directives from Solr
> ---------------------------------
>
>                 Key: SOLR-16781
>                 URL: https://issues.apache.org/jira/browse/SOLR-16781
>             Project: Solr
>          Issue Type: Improvement
>            Reporter: Ishan Chattopadhyaya
>            Priority: Blocker
>             Fix For: 8.11.3
>
>         Attachments: SOLR-16781-1.patch, SOLR-16781-2.patch, SOLR-16781.patch
>
>
> <lib> directives in solrconfig.xml used to be recommended way for including additional jar files to the classpath for a particular collection or collections.
> For context: This feature required complex handling of "trusted" vs "non-trusted" configsets in configset upload API to keep Solr secure (i.e. to stop RCE attacks for non-authentication enabled deployments). This security feature also broke down recently due to a bug in Schema designer (SOLR-16777).
> Supported alternatives exist that are safer:
>  * user can add the jar files to Solr's classpath
>  * use packages to use custom jars per collection
> In the light of these, there's no need to continue to support the <lib> directive going forward.
> I propose to remove the <lib> directives handling and functionality through this issue.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org