You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@lucene.apache.org by GitBox <gi...@apache.org> on 2020/01/08 11:52:10 UTC
[GitHub] [lucene-solr] Sachpat opened a new pull request #1156: SOLR-13971
Sachpat opened a new pull request #1156: SOLR-13971
URL: https://github.com/apache/lucene-solr/pull/1156
# Description
This is the fix for CVE-2019-17558: Velocity custom template RCE vulnerability, which was fixed for 8.3 and I provided the same fix for 7.7 as per the discussion here:
https://issues.apache.org/jira/browse/SOLR-13971?focusedCommentId=17010489&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17010489
# Checklist
Please review the following and check all that apply:
- [ x] I have reviewed the guidelines for [How to Contribute](https://wiki.apache.org/solr/HowToContribute) and my code conforms to the standards described there to the best of my ability.
- [x ] I have created a Jira issue and added the issue ID to my pull request title.
- [ x] I have given Solr maintainers [access](https://help.github.com/en/articles/allowing-changes-to-a-pull-request-branch-created-from-a-fork) to contribute to my PR branch. (optional but recommended)
- [x] I have developed this patch against the `master` branch.
- [x] I have run `ant precommit` and the appropriate test suite.
- [x] I have added tests for my changes.
- [ x] I have added documentation for the [Ref Guide](https://github.com/apache/lucene-solr/tree/master/solr/solr-ref-guide) (for Solr changes only).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971:
CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156#issuecomment-572108472
@erikhatcher I also committed the changes for SOLR-14025 in this.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] Sachpat commented on a change in pull request #1156:
SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
Sachpat commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156#discussion_r364293742
##########
File path: solr/contrib/velocity/src/java/org/apache/solr/response/VelocityResponseWriter.java
##########
@@ -231,25 +222,32 @@ private VelocityContext createContext(SolrQueryRequest request, SolrQueryRespons
resourceTool.configure(toolConfig);
context.put("resource", resourceTool);
-/*
- // Custom tools, specified in config as:
- <queryResponseWriter name="velocityWithCustomTools" class="solr.VelocityResponseWriter">
- <lst name="tools">
- <str name="mytool">com.example.solr.velocity.MyTool</str>
- </lst>
- </queryResponseWriter>
-*/
- // Custom tools can override any of the built-in tools provided above, by registering one with the same name
- for(String name : customTools.keySet()) {
- Object customTool = SolrCore.createInstance(customTools.get(name), Object.class, "VrW custom tool: " + name, request.getCore(), request.getCore().getResourceLoader());
- if (customTool instanceof LocaleConfig) {
- ((LocaleConfig)customTool).configure(toolConfig);
+ if (request.getCore().getCoreDescriptor().isConfigSetTrusted()) {
+ // Load custom tools, only if in a trusted configset
+
+ /*
+ // Custom tools, specified in config as:
+ <queryResponseWriter name="velocityWithCustomTools" class="solr.VelocityResponseWriter">
+ <lst name="tools">
+ <str name="mytool">com.example.solr.velocity.MyTool</str>
+ </lst>
+ </queryResponseWriter>
+ */
+ // Custom tools can override any of the built-in tools provided above, by registering one with the same name
+ if (request.getCore().getCoreDescriptor().isConfigSetTrusted()) {
Review comment:
Yes, that's right @artem-smotrakov . Actually I tried to align the code according to the original patch https://github.com/apache/lucene-solr/commit/9dfee35b9facbcbc9342d8bbbe52667cb6d1dced. It was also the same there :) @erikhatcher , should I change it or keep it as it is?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] artem-smotrakov commented on a change in pull request
#1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
artem-smotrakov commented on a change in pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156#discussion_r364279451
##########
File path: solr/contrib/velocity/src/java/org/apache/solr/response/VelocityResponseWriter.java
##########
@@ -231,25 +222,32 @@ private VelocityContext createContext(SolrQueryRequest request, SolrQueryRespons
resourceTool.configure(toolConfig);
context.put("resource", resourceTool);
-/*
- // Custom tools, specified in config as:
- <queryResponseWriter name="velocityWithCustomTools" class="solr.VelocityResponseWriter">
- <lst name="tools">
- <str name="mytool">com.example.solr.velocity.MyTool</str>
- </lst>
- </queryResponseWriter>
-*/
- // Custom tools can override any of the built-in tools provided above, by registering one with the same name
- for(String name : customTools.keySet()) {
- Object customTool = SolrCore.createInstance(customTools.get(name), Object.class, "VrW custom tool: " + name, request.getCore(), request.getCore().getResourceLoader());
- if (customTool instanceof LocaleConfig) {
- ((LocaleConfig)customTool).configure(toolConfig);
+ if (request.getCore().getCoreDescriptor().isConfigSetTrusted()) {
+ // Load custom tools, only if in a trusted configset
+
+ /*
+ // Custom tools, specified in config as:
+ <queryResponseWriter name="velocityWithCustomTools" class="solr.VelocityResponseWriter">
+ <lst name="tools">
+ <str name="mytool">com.example.solr.velocity.MyTool</str>
+ </lst>
+ </queryResponseWriter>
+ */
+ // Custom tools can override any of the built-in tools provided above, by registering one with the same name
+ if (request.getCore().getCoreDescriptor().isConfigSetTrusted()) {
Review comment:
Looks like it checks `request.getCore().getCoreDescriptor().isConfigSetTrusted()` twice. I suppose one check may be removed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971:
CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
Sachpat commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156#issuecomment-573690564
Thanks for merging it @chatman . Will close this PR now.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] chatman commented on issue #1156: SOLR-13971:
CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
chatman commented on issue #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156#issuecomment-573683286
Merged. Thanks. Lets close this PR.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] Sachpat closed pull request #1156: SOLR-13971:
CVE-2019-17558: Velocity custom template RCE vulnerability
Posted by GitBox <gi...@apache.org>.
Sachpat closed pull request #1156: SOLR-13971: CVE-2019-17558: Velocity custom template RCE vulnerability
URL: https://github.com/apache/lucene-solr/pull/1156
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org
[GitHub] [lucene-solr] Sachpat commented on issue #1156: SOLR-13971
Posted by GitBox <gi...@apache.org>.
Sachpat commented on issue #1156: SOLR-13971
URL: https://github.com/apache/lucene-solr/pull/1156#issuecomment-572017436
@chatman please take a look :)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org