[GitHub] [lucene-solr] uschindler edited a comment on pull request #1849: LUCENE-9517: Add doPrivileged block when creating BugfixDeflater_JDK8252739 objects

[GitBox <gi...@apache.org>]

uschindler edited a comment on pull request #1849:
URL: https://github.com/apache/lucene-solr/pull/1849#issuecomment-689635578


   The problem with the fix here is:
   - I have no idea how the stack trace looks like. And under which circumstances you see this bug. Can you post a link to your CI, to see if it is causeed by the CI infrastrcuture? Does it also break with production ready software? How?
   - Have you opened a bug report in JDK 10, 11 (it's caused by this change: https://bugs.openjdk.java.net/browse/JDK-8185582)? Should I do?
   - The workaround may only work for Elasticsearch, because lucene-core.jar has the accessDeclaredMembers permission given due to the MMapDirectory hack. But the problem is that we take now the responsibility for any bad stuff the Deflater internals are doing. If you remove the permission from Lucene's code, it won't work anymore.
   
   IMHO, as a workaround for this bug, you should add a method to your security manager which explicitely allows this access, if it finds the JDK class in the stack trace (similarily implemented like the checkExit() method in Lucene's test SecurityManager ando also the code that disallows calling System.exit() in Elasticsearch). So the workaround should really be in the consuming code.
   
   Are there any other ways how to workaround this bug?
   
   Why does this PR help for this bug (I don't know the stack trace)?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org