You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2023/02/20 01:25:00 UTC
[jira] [Commented] (SOLR-16671) Explicitly call out library permissions for config-edit
[ https://issues.apache.org/jira/browse/SOLR-16671?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17690961#comment-17690961 ]
ASF subversion and git services commented on SOLR-16671:
--------------------------------------------------------
Commit d6b8f300711a59230531c855809debb745eb72a8 in solr's branch refs/heads/main from Houston Putman
[ https://gitbox.apache.org/repos/asf?p=solr.git;h=d6b8f300711 ]
SOLR-16671: Explicitly call out library permissions for config-edit (#1370)
> Explicitly call out library permissions for config-edit
> -------------------------------------------------------
>
> Key: SOLR-16671
> URL: https://issues.apache.org/jira/browse/SOLR-16671
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Components: Authorization, documentation, security
> Reporter: Houston Putman
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> A lot of security questions arise from various options to add custom libraries via a {{{}solrconfig.xml{}}}. When using the recommended solr auth plugin, a user requires the {{config-edit}} permission to edit this file. And custom libraries will only be used when the solrconfig is trusted by Solr.
> Right now the [config-edit permission documentation|https://solr.apache.org/guide/solr/9_1/deployment-guide/rule-based-authorization-plugin.html#predefined-permissions] does not explicitly spell out that the permission gives users the ability to install any custom library to Solr. We should fix this to reduce confusion around RCEs.
> With our antora docs, I suggest we backport this documentation change to 9.0 and 9.1, and also update 8.11 for the next patch release.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org