[
https://issues.apache.org/jira/browse/GROOVY-12348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110947#comment-18110947
]
ASF GitHub Bot commented on GROOVY-12348:
-----------------------------------------
paulk-asert opened a new pull request, #2870:
URL: https://github.com/apache/groovy/pull/2870
connectorServer takes a host, defaulting to localhost, but it reached only
the service URL. The authority before /jndi/ was left empty, which exports the
RMI object on every interface, so host named the registry the stub was bound
into and never restricted the listener. A connector asked for localhost was
reachable from any host that could route to the port, and since the default
MBean server is the platform one, that offered HotSpotDiagnostic.dumpHeap and
the DiagnosticCommand operations to whoever arrived.
The connector now binds the host it was given. Both halves are needed: the
server socket factory decides where the exported object listens, and the stub
carries the client factory, which decides where a client dials. Binding without
the second leaves clients dialling the host RMI advertises, where nothing is
listening. A caller who supplied either factory keeps their own, so the SSL
path is untouched, and a wildcard host still listens everywhere.
Starting a connector that both reaches other hosts and authenticates nobody
now warns. A connector confined to loopback stays quiet, so the warning marks
the case where a peer other than the operator can arrive.
The documentation recorded that its own example failed on Mac and CentOS 5
under Groovy 1.6 and wondered about /etc/hosts. The example fails because it
does not create the RMI registry, which the corrected example below it already
showed, so it now says that and describes what the connector exposes and to
whom.
> Harden JMXBuilder configuration
> -------------------------------
>
> Key: GROOVY-12348
> URL: https://issues.apache.org/jira/browse/GROOVY-12348
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
