You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tinkerpop.apache.org by "Dan Snoddy (Jira)" <ji...@apache.org> on 2022/12/06 15:13:00 UTC

[jira] [Created] (TINKERPOP-2835) Query translation ignores sandbox limitations

Dan Snoddy created TINKERPOP-2835:
-------------------------------------

             Summary: Query translation ignores sandbox limitations
                 Key: TINKERPOP-2835
                 URL: https://issues.apache.org/jira/browse/TINKERPOP-2835
             Project: TinkerPop
          Issue Type: Bug
            Reporter: Dan Snoddy


When I run a query such as g.V().has('NAME',System.getenv()) our sandbox configuration blocks the execution of System.getenv(), however if the request is passed to one of the translators (e.g. GroovyTranslator), the query is executed (and could be used to reboot a machine, kill the Java VM, run OS level commands, etc):



g.V().has("NAME",[("PATH"):("/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin .....

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)