You are viewing a plain text version of this content. The canonical link for it is here.
Posted to solr-user@lucene.apache.org by Doug Turnbull <dt...@opensourceconnections.com> on 2015/09/27 01:49:49 UTC
Sleep function query a big security hole?
I noticed a while back that "sleep" is a function query. Which I
believe means I can make the current query thread sleep for as long as I
like.
I'm guessing an attacker could use this to starve Solr of threads, running
a denial of service attack by running multiple queries with sleeps in them.
Is this a concern? I realize there may be test purposes to sleep a function
query, but I'm trying to think if there's really practical purpose to
having sleep here.
Best,
-Doug
--
*Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
<http://opensourceconnections.com>, LLC | 240.476.9983
Author: Relevant Search <http://manning.com/turnbull>
This e-mail and all contents, including attachments, is considered to be
Company Confidential unless explicitly stated otherwise, regardless
of whether attachments are marked as such.
Re: Sleep function query a big security hole?
Posted by Doug Turnbull <dt...@opensourceconnections.com>.
Great! Thanks
-Doug
On Sun, Sep 27, 2015 at 9:28 AM, Ishan Chattopadhyaya <
ichattopadhyaya@gmail.com> wrote:
> +1, I agree. Opened https://issues.apache.org/jira/browse/SOLR-8099
> Thanks,
> Ishan
>
> On Sun, Sep 27, 2015 at 5:22 AM, Doug Turnbull <
> dturnbull@opensourceconnections.com> wrote:
>
> > Relevant code
> >
> >
> http://grepcode.com/file/repo1.maven.org/maven2/org.apache.solr/solr-core/5.2.0/org/apache/solr/search/ValueSourceParser.java#126
> >
> > On Saturday, September 26, 2015, Doug Turnbull <
> > dturnbull@opensourceconnections.com> wrote:
> >
> > > I noticed a while back that "sleep" is a function query. Which I
> > > believe means I can make the current query thread sleep for as long as
> I
> > > like.
> > >
> > > I'm guessing an attacker could use this to starve Solr of threads,
> > running
> > > a denial of service attack by running multiple queries with sleeps in
> > them.
> > >
> > > Is this a concern? I realize there may be test purposes to sleep a
> > > function query, but I'm trying to think if there's really practical
> > purpose
> > > to having sleep here.
> > >
> > > Best,
> > > -Doug
> > >
> > >
> > > --
> > > *Doug Turnbull **| *Search Relevance Consultant | OpenSource
> Connections
> > > <http://opensourceconnections.com>, LLC | 240.476.9983
> > > Author: Relevant Search <http://manning.com/turnbull>
> > > This e-mail and all contents, including attachments, is considered to
> be
> > > Company Confidential unless explicitly stated otherwise, regardless
> > > of whether attachments are marked as such.
> > >
> > >
> >
> > --
> > *Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
> > <http://opensourceconnections.com>, LLC | 240.476.9983
> > Author: Relevant Search <http://manning.com/turnbull>
> > This e-mail and all contents, including attachments, is considered to be
> > Company Confidential unless explicitly stated otherwise, regardless
> > of whether attachments are marked as such.
> >
>
--
*Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
<http://opensourceconnections.com>, LLC | 240.476.9983
Author: Relevant Search <http://manning.com/turnbull>
This e-mail and all contents, including attachments, is considered to be
Company Confidential unless explicitly stated otherwise, regardless
of whether attachments are marked as such.
Re: Sleep function query a big security hole?
Posted by Ishan Chattopadhyaya <ic...@gmail.com>.
+1, I agree. Opened https://issues.apache.org/jira/browse/SOLR-8099
Thanks,
Ishan
On Sun, Sep 27, 2015 at 5:22 AM, Doug Turnbull <
dturnbull@opensourceconnections.com> wrote:
> Relevant code
>
> http://grepcode.com/file/repo1.maven.org/maven2/org.apache.solr/solr-core/5.2.0/org/apache/solr/search/ValueSourceParser.java#126
>
> On Saturday, September 26, 2015, Doug Turnbull <
> dturnbull@opensourceconnections.com> wrote:
>
> > I noticed a while back that "sleep" is a function query. Which I
> > believe means I can make the current query thread sleep for as long as I
> > like.
> >
> > I'm guessing an attacker could use this to starve Solr of threads,
> running
> > a denial of service attack by running multiple queries with sleeps in
> them.
> >
> > Is this a concern? I realize there may be test purposes to sleep a
> > function query, but I'm trying to think if there's really practical
> purpose
> > to having sleep here.
> >
> > Best,
> > -Doug
> >
> >
> > --
> > *Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
> > <http://opensourceconnections.com>, LLC | 240.476.9983
> > Author: Relevant Search <http://manning.com/turnbull>
> > This e-mail and all contents, including attachments, is considered to be
> > Company Confidential unless explicitly stated otherwise, regardless
> > of whether attachments are marked as such.
> >
> >
>
> --
> *Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
> <http://opensourceconnections.com>, LLC | 240.476.9983
> Author: Relevant Search <http://manning.com/turnbull>
> This e-mail and all contents, including attachments, is considered to be
> Company Confidential unless explicitly stated otherwise, regardless
> of whether attachments are marked as such.
>
Re: Sleep function query a big security hole?
Posted by Doug Turnbull <dt...@opensourceconnections.com>.
Relevant code
http://grepcode.com/file/repo1.maven.org/maven2/org.apache.solr/solr-core/5.2.0/org/apache/solr/search/ValueSourceParser.java#126
On Saturday, September 26, 2015, Doug Turnbull <
dturnbull@opensourceconnections.com> wrote:
> I noticed a while back that "sleep" is a function query. Which I
> believe means I can make the current query thread sleep for as long as I
> like.
>
> I'm guessing an attacker could use this to starve Solr of threads, running
> a denial of service attack by running multiple queries with sleeps in them.
>
> Is this a concern? I realize there may be test purposes to sleep a
> function query, but I'm trying to think if there's really practical purpose
> to having sleep here.
>
> Best,
> -Doug
>
>
> --
> *Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
> <http://opensourceconnections.com>, LLC | 240.476.9983
> Author: Relevant Search <http://manning.com/turnbull>
> This e-mail and all contents, including attachments, is considered to be
> Company Confidential unless explicitly stated otherwise, regardless
> of whether attachments are marked as such.
>
>
--
*Doug Turnbull **| *Search Relevance Consultant | OpenSource Connections
<http://opensourceconnections.com>, LLC | 240.476.9983
Author: Relevant Search <http://manning.com/turnbull>
This e-mail and all contents, including attachments, is considered to be
Company Confidential unless explicitly stated otherwise, regardless
of whether attachments are marked as such.