Thomas Mueller created OAK-2107:
-----------------------------------
Summary: Remove the MongoGridFSBlobStore implementation
Key: OAK-2107
URL: https://issues.apache.org/jira/browse/OAK-2107
Project: Jackrabbit Oak
Issue Type: Bug
Components: mongomk
Reporter: Thomas Mueller
Assignee: Thomas Mueller
Priority: Minor
Fix For: 1.1
The MongoGridFSBlobStore implementation relies on using MD5 as the content
hash, which is dangerous. This isn't a problem of GridFS itself, but of
MongoGridFSBlobStore.
For security reasons, we would need to use SHA-2 (or at least SHA-1). It
doesn't look like it would be easy to change MongoGridFSBlobStore, because
"md5" is used internally by GridFS (but not actually as the content hash).
So either we make a bigger change to MongoGridFSBlobStore, or we remove it. I
think we should remove it, as we have a good alternative (the MongoBlobStore,
which uses SHA-256, but not GridFS).
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
