[
https://issues.apache.org/jira/browse/SOLR-11495?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18133449#comment-18133449
]
Jan Høydahl commented on SOLR-11495:
------------------------------------
A clarifying doc sounds like a good solution here.
> Reduce the list of which query parsers are loaded by default
> ------------------------------------------------------------
>
> Key: SOLR-11495
> URL: https://issues.apache.org/jira/browse/SOLR-11495
> Project: Solr
> Issue Type: Bug
> Components: query parsers
> Affects Versions: 7.0
> Reporter: Shawn Heisey
> Priority: Major
>
> Virtually all of the query parsers that Solr supports are enabled by default,
> in a map created in QParserPlugin.java.
> To reduce the possible attack surface of a default Solr installation, I
> believe that the list of default parsers should be limited to a small handful
> of the full list that's available. I will discuss specific ideas for that
> list in comments.
> I think the bar should be very high for admission to the default parser list.
> That list should only include those that are most commonly used by the
> community. Only the most common parsers will have had extensive review for
> security issues.
> _Edit_: moved description from "Docs Text" field where it was initially added
> mistakenly.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
