imbajin commented on code in PR #3350:
URL: https://github.com/apache/hugegraph/pull/3350#discussion_r4278925786
##########
hugegraph-server/hugegraph-core/src/main/java/org/apache/hugegraph/security/HugeSecurityManager.java:
##########
@@ -66,11 +66,16 @@ public class HugeSecurityManager extends SecurityManager {
"java.specification.version"
);
+ private static final Set<String> ASYNC_SCHEMA_METHODS = ImmutableSet.of(
+ "removeVertexLabel", "removeEdgeLabel", "removeIndexLabel",
"rebuildIndex"
Review Comment:
Confirmed and fixed for both schema transactions. The three PropertyKey OLAP
entry points now submit through a private scheduleOlapJob helper, and only that
helper is added to the shared allowlist. This avoids also permitting the V2
synchronous Id overloads, since stack matching cannot distinguish overload
signatures.
The real Gremlin regression exercises index rebuilding and all three OLAP
submissions without starting a worker. Negative controls keep ordinary thread
creation, system-property access, and thread creation attempted from each
synchronous Id overload denied. The overly broad public-name variant was
verified to fail the new boundary controls; the narrowed version passes
formatting, full Java 17 compilation and the focused regression. Independent
final review passed. Live HStore acceptance remains pending.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
