[
https://issues.apache.org/jira/browse/SOLR-14071?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16995407#comment-16995407
]
ASF subversion and git services commented on SOLR-14071:
--------------------------------------------------------
Commit 790d4ca8a76cf61b1b95ec0ef903daf862fb7784 in lucene-solr's branch
refs/heads/branch_8_4 from Ishan Chattopadhyaya
[ https://gitbox.apache.org/repos/asf?p=lucene-solr.git;h=790d4ca ]
SOLR-14071: Untrusted configsets shouldn't be allowed to use <lib> directive
> Untrusted configsets shouldn't be allowed to use <lib> directive
> ----------------------------------------------------------------
>
> Key: SOLR-14071
> URL: https://issues.apache.org/jira/browse/SOLR-14071
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Ishan Chattopadhyaya
> Assignee: Ishan Chattopadhyaya
> Priority: Blocker
> Fix For: 8.4
>
> Time Spent: 2h 40m
> Remaining Estimate: 0h
>
> Allowing untrusted configsets, i.e. those have been uploaded using the
> configset upload API without authx enabled, to use the <lib> directive can
> open up possibilities for malicious users to include insecure contribs
> libraries.
> Whoever wants to use their own libraries can add them to the classpath of
> Solr (i.e. place them wherever solr-core-*jar resides). For them, the <lib>
> directive won't be necessary anyway.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
