[jira] [Commented] (TINKERPOP-2583) Make gremlin-groovy processing optional in Gremlin Server

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TINKERPOP-2583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17436143#comment-17436143 ] 

ASF GitHub Bot commented on TINKERPOP-2583:
-------------------------------------------

spmallette opened a new pull request #1489:
URL: https://github.com/apache/tinkerpop/pull/1489


   https://issues.apache.org/jira/browse/TINKERPOP-2583
   
   `GremlinLangScriptEngine` uses the grammar to eval the Gremln scripts. Only enabled its usage for the test server yaml files. Not expecting to enable it along 3.5.x but wanted the functionality here in case folks want to play with it a bit. This change obviously doesn't satisfy TINKERPOP-2583, but it is a first step. 
   
   Builds with `mvn clean install && mvn verify -pl gremlin-server -DskipIntegrationTests=false`
   
   VOTE +1


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@tinkerpop.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


> Make gremlin-groovy processing optional in Gremlin Server
> ---------------------------------------------------------
>
>                 Key: TINKERPOP-2583
>                 URL: https://issues.apache.org/jira/browse/TINKERPOP-2583
>             Project: TinkerPop
>          Issue Type: Improvement
>          Components: server
>    Affects Versions: 3.6.0
>            Reporter: Stephen Mallette
>            Assignee: Stephen Mallette
>            Priority: Blocker
>
> Make it so that gremlin-groovy is an opt-in bit of functionality for Gremlin Server and by default instead rely on traversals generated from gremlin-language as implemented in TINKERPOP-2582. In this way, we have a secure Gremlin Server by default.
> One of the problems with disabling gremlin-groovy processing is that we require it for the init script to the server. Without that, we have no mechanism that allows configuration of "g" and other important bits. It could be that we need to retain gremlin-groovy for that purpose and just prevent it from being called externally. Not sure that's so good though because removing Groovy more wholly would be nice given TINKERPOP-2526



--
This message was sent by Atlassian Jira
(v8.3.4#803005)