bitflicker64 commented on code in PR #3350:
URL: https://github.com/apache/hugegraph/pull/3350#discussion_r4277810245
##########
hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/security/HugeSecurityManager.java:
##########
@@ -66,11 +66,16 @@ public class HugeSecurityManager extends SecurityManager {
"java.specification.version"
);
+ private static final Set<String> ASYNC_SCHEMA_METHODS = ImmutableSet.of(
+ "removeVertexLabel", "removeEdgeLabel", "removeIndexLabel",
"rebuildIndex"
Review Comment:
Important: This set still leaves out the other schema methods that submit a
task through `asyncRun()`, so OLAP property keys keep the same 403 this PR
fixes for indexes. In `SchemaTransactionV2`, `addPropertyKey()` calls
`createOlapPk(PropertyKey)` (line 158), `removePropertyKey()` calls
`removeOlapPk(PropertyKey)` (line 216), and
`StandardHugeGraph.clearPropertyKey()` calls `clearOlapPk(PropertyKey)` (line
963). All three reach `JobBuilder.schedule()` through `asyncRun()` at lines
602, 613 and 624, the same path `rebuildIndex()` takes, and
`HstoreFeatures.supportsOlapProperties()` returns true, so these calls are
reachable on HStore. None of these frames is in `ASYNC_TASKS`, so when the
schema executor needs a new worker, `checkAccess(ThreadGroup)` rejects the
call. I checked this at this head by copying `SchemaTaskSecurityTest` and
adding `tx.createOlapPk(pk)` with a `PropertyKey` binding: under
`HugeSecurityManager` it throws `SecurityException: Not allowed to access
thread gro
up via Gremlin`, while `tx.rebuildIndex(index)` in the same test passes.
`SchemaTransaction` (V1) has the same gap at lines 409, 416 and 423, so the PR
does not make this worse, but the shared set it introduces is the one place to
fix both. Please add `createOlapPk`, `clearOlapPk` and `removeOlapPk` to
`ASYNC_SCHEMA_METHODS`, and add an OLAP case to `SchemaTaskSecurityTest`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
