[
https://issues.apache.org/jira/browse/SOLR-11495?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132116#comment-18132116
]
Nick Shanin commented on SOLR-11495:
------------------------------------
>From code reading against apache/main b73f03976fa, every standard query parser
>is registered by default
>(solr/core/src/java/org/apache/solr/search/QParserPlugin.java:47-99), and the
>production guide does not say so. A candidate is a docs section on the default
>parsers and how to shadow one from solrconfig. Is that enough?
🤖 AI-generated 🤖
> Reduce the list of which query parsers are loaded by default
> ------------------------------------------------------------
>
> Key: SOLR-11495
> URL: https://issues.apache.org/jira/browse/SOLR-11495
> Project: Solr
> Issue Type: Bug
> Components: query parsers
> Affects Versions: 7.0
> Reporter: Shawn Heisey
> Priority: Major
>
> Virtually all of the query parsers that Solr supports are enabled by default,
> in a map created in QParserPlugin.java.
> To reduce the possible attack surface of a default Solr installation, I
> believe that the list of default parsers should be limited to a small handful
> of the full list that's available. I will discuss specific ideas for that
> list in comments.
> I think the bar should be very high for admission to the default parser list.
> That list should only include those that are most commonly used by the
> community. Only the most common parsers will have had extensive review for
> security issues.
> _Edit_: moved description from "Docs Text" field where it was initially added
> mistakenly.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
