[
https://issues.apache.org/jira/browse/HBASE-14347?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14941392#comment-14941392
]
Matteo Bertozzi commented on HBASE-14347:
-----------------------------------------
[~esteban] in theory we are already supposed to do the "remote" load. the
problem is the code that copies those "remote" locally. I think that was done
because it was the easy way to load the class form remote since you have the
friendly API that loads the class by using addUrl() where url is expected to be
something that java understand and hdfs is not.
Looking at the classLoader API there is a defineClass() that takes an array of
bytes. In theory we can leverage that to open the hdfs stream (the jar we want
to load) and add the class to our class loader and avoid the copy-to-local
step. In that way we can get even rid of the tmp dir.
https://docs.oracle.com/javase/7/docs/api/java/security/SecureClassLoader.html#defineClass(java.lang.String,%20byte[],%20int,%20int,%20java.security.CodeSource)
I'll let [~huaxiang] look into that, if it is something possible or not.
> Add a switch to DynamicClassLoader to disable it and make that the default
> --------------------------------------------------------------------------
>
> Key: HBASE-14347
> URL: https://issues.apache.org/jira/browse/HBASE-14347
> Project: HBase
> Issue Type: Bug
> Components: Client, defaults, regionserver
> Affects Versions: 2.0.0, 1.2.0, 1.1.2, 0.98.15, 1.0.3
> Reporter: Esteban Gutierrez
> Assignee: huaxiang sun
> Attachments: HBASE-14347-v001.patch
>
>
> Since HBASE-1936 we have the option to load jars dynamically by default from
> HDFS or the local filesystem, however hbase.dynamic.jars.dir points to a
> directory that could be world writable it potentially opens a security
> problem in both the client side and the RS. We should consider to have a
> switch to enable or disable this option and it should be off by default.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
