You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Jason Gerlowski (Jira)" <ji...@apache.org> on 2024/11/18 20:29:00 UTC
[jira] [Commented] (SOLR-16781) Remove directives from Solr
[ https://issues.apache.org/jira/browse/SOLR-16781?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17899255#comment-17899255 ]
Jason Gerlowski commented on SOLR-16781:
----------------------------------------
There's been some discussion of this ticket on our "security@solr.apache.org" mailing list in relation to a potential-vulnerability report that came in from a user. I'll be able to share more details on that here once a fix has been released.
But the main takeaway from that thread is that we should be more aggressive and remove support for "<lib>" (or at the very least disable it by default) starting in 9.8. So, with that in mind, I'm going to revive Ishan's 8.x patch with an eye to target 'main' and 'branch_9x'.
> Remove <lib> directives from Solr
> ---------------------------------
>
> Key: SOLR-16781
> URL: https://issues.apache.org/jira/browse/SOLR-16781
> Project: Solr
> Issue Type: Improvement
> Reporter: Ishan Chattopadhyaya
> Priority: Blocker
> Fix For: main (10.0)
>
> Attachments: SOLR-16781-1.patch, SOLR-16781-2.patch, SOLR-16781.patch
>
>
> <lib> directives in solrconfig.xml used to be recommended way for including additional jar files to the classpath for a particular collection or collections.
> For context: This feature required complex handling of "trusted" vs "non-trusted" configsets in configset upload API to keep Solr secure (i.e. to stop RCE attacks for non-authentication enabled deployments). This security feature also broke down recently due to a bug in Schema designer (SOLR-16777).
> Supported alternatives exist that are safer:
> * user can add the jar files to Solr's classpath
> * use packages to use custom jars per collection
> In the light of these, there's no need to continue to support the <lib> directive going forward.
> I propose to remove the <lib> directives handling and functionality through this issue.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org