contrueCT opened a new pull request, #3301: URL: https://github.com/apache/hugegraph/pull/3301
## Purpose of the PR Fixes #3300. The first Gremlin traversal can initialize `ConditionQuery` and Gson on a restricted worker, where Gson's `java.version` read is denied. Failed class initialization then breaks later queries in the same JVM. Initialize the serializer on the trusted startup thread before either REST or Gremlin accepts requests. ## Main Changes - Construct a condition query during startup to actually initialize Gson; a class literal would leave it lazy. - Add a fresh-JVM regression with the real Gremlin engine, subsequent trusted query construction and checks that restricted-property and security-manager access remain denied. ## Verifying these changes - [ ] Trivial rework / code cleanup without any test coverage. (No Need) - [x] `ColdGremlinQueryTest` passes on Java 17 with no failures/errors/skips; it models the Java query construction reached from a Gremlin script. - [x] A control using the original startup behavior, with the initialization hook left empty, fails with `ConditionQuery -> Gson -> JavaVersion` and the denied `java.version` property. Full HTTP deployment was not repeated; the issue links the original deployment reproduction. - [x] Server distribution/dependency reactor clean compilation, editorconfig formatting and `git diff --check` pass. ## Does this PR potentially affect the following parts? - [ ] Dependencies - [ ] Modify configurations - [ ] The public API - [x] Other affects: query serializer initialization before service readiness - [ ] Nope ## Documentation Status - [ ] `Doc - TODO` - [x] `Doc - Done`: `docs/upgrade-tinkerpop-3.8.md` documents first-query behavior and retained restrictions. - [ ] `Doc - No Need` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
