[
https://issues.apache.org/jira/browse/SOLR-13987?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16988432#comment-16988432
]
Robert Muir commented on SOLR-13987:
------------------------------------
I don't disagree with any point you made: thank you for the thoughtful comments.
I know people will hate my changes. But I think I'm kinda the necessary
personality to fix this shit. I'm doing it on my own time with no interference
or bad corporate influence to prevent me from doing the right thing. I am sick
of the vulnerabilities and think we can fix it.
The problem with solr is, it has too many features, especially super-risky ones
like exposing scripting languages, running code from "god knows where", and
admin UI setup like this. It is the very definition of security disaster,
that's why people exploit it. And I look forward to some good fun with solr in
security conference CTFs in the future.
If they want to veto some change to the admin UI, ok fine. I'm not trying to
break functionality, just being honest: we have a problem. If you look at the
linked issue, there is documentation from angular on how to fix it. But I'm
just not that heavy of a JS guy, admitting my weaknesses. I don't care if the
thing is used, i just want {{unsafe-eval}} to disappear from the
Content-Security-Policy.
And on my list, XSS is honestly down there. Its just a matter of priorities.
But because this thing makes it so trivial, its gonna generate tons and tons of
CVEs and problems. Saying "you should firewall this shit" is just an excuse,
sorry. Of course you should firewall it. Of course, even if we secure this solr
thing, you shouldn't expose it to the internet, don't be an idiot.
But we shouldn't have these kind of security bugs and just pretend like they
are ok.
> fix admin UI to not rely on javascript eval()
> ---------------------------------------------
>
> Key: SOLR-13987
> URL: https://issues.apache.org/jira/browse/SOLR-13987
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Robert Muir
> Priority: Major
>
> Followup from SOLR-13982: currently any CSP is weak because it must allow
> this eval: means arbitrary javascript can still be executed.
> Let's fix the admin UI to not require eval so it can be disabled by the
> browser.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
