Re: SocketPermission exception when calling an external REST API from within a custom TokenFilter

Alexandros Paramythis Thu, 09 Nov 2023 07:36:40 -0800

Hi Ishan,

Thanks for the suggestion. I had actually tried that and had run intodifferent problems. On a solr 9.1.1 installation (on Windows in casethis makes a difference), I get the following two sets of exceptions inthe logs.


First indication that something is very wrong:

2023-11-09 15:16:15.098 INFO (coreLoadExecutor-10-thread-3) [x:test_core] o.a.s.c.SolrCore CLOSING SolrCoreorg.apache.solr.core.SolrCore@5e1f0593 test_core2023-11-09 15:16:15.099 INFO (coreLoadExecutor-10-thread-3) [x:test_core] o.a.s.m.SolrMetricManager Closing metric reporters forregistry=solr.core.test_core tag=SolrCore@5e1f05932023-11-09 15:16:15.110 ERROR(searcherExecutor-14-thread-1-processing-test_core) [ x:test_core]o.a.s.h.RequestHandlerBase java.lang.NullPointerException =>java.lang.NullPointerException atorg.apache.solr.handler.component.SearchHandler.initComponents(SearchHandler.java:248)

java.lang.NullPointerException: null

atorg.apache.solr.handler.component.SearchHandler.initComponents(SearchHandler.java:248)~[?:?] atorg.apache.solr.handler.component.SearchHandler.getComponents(SearchHandler.java:268)~[?:?] atorg.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:336)~[?:?] atorg.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:224)~[?:?]

    at org.apache.solr.core.SolrCore.execute(SolrCore.java:2865) ~[?:?]

atorg.apache.solr.core.QuerySenderListener.newSearcher(QuerySenderListener.java:75)~[?:?] atorg.apache.solr.core.SolrCore.lambda$getSearcher$18(SolrCore.java:2620)~[?:?]

    at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]

atorg.apache.solr.common.util.ExecutorUtil$MDCAwareThreadPoolExecutor.lambda$execute$0(ExecutorUtil.java:271)~[solr-solrj-9.1.0.jar:9.1.0 aa4f3d98ab19c201e7f3c74cd14c99174148616d -ishan - 2022-11-11 13:00:47] atjava.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)~[?:?] atjava.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)~[?:?]

    at java.lang.Thread.run(Thread.java:834) ~[?:?]

And further down the logs also the following:

2023-11-09 15:16:17.994 ERROR (coreContainerWorkExecutor-2-thread-1) []o.a.s.c.CoreContainer Error waiting for SolrCore to be loaded on startup=> java.util.concurrent.ExecutionException:org.apache.solr.common.SolrException: Unable to create core [test_core] atjava.base/java.util.concurrent.FutureTask.report(FutureTask.java:122)java.util.concurrent.ExecutionException:org.apache.solr.common.SolrException: Unable to create core [test_core]

    at java.util.concurrent.FutureTask.report(FutureTask.java:122) ~[?:?]
    at java.util.concurrent.FutureTask.get(FutureTask.java:191) ~[?:?]

atorg.apache.solr.core.CoreContainer.lambda$load$13(CoreContainer.java:1009)~[?:?] atcom.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180)~[metrics-core-4.1.5.jar:4.1.5] atjava.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)~[?:?]

    at java.util.concurrent.FutureTask.run(FutureTask.java:264) ~[?:?]

    at java.lang.Thread.run(Thread.java:834) ~[?:?]

Caused by: org.apache.solr.common.SolrException: Unable to create core[test_core] atorg.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1613)~[?:?] atorg.apache.solr.core.CoreContainer.lambda$load$12(CoreContainer.java:980)~[?:?] atcom.codahale.metrics.InstrumentedExecutorService$InstrumentedCallable.call(InstrumentedExecutorService.java:202)~[metrics-core-4.1.5.jar:4.1.5]

    ... 5 more

Caused by: org.apache.solr.common.SolrException:org/objectweb/asm/util/Printer

    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1203) ~[?:?]
    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1047) ~[?:?]

atorg.apache.solr.core.CoreContainer.createFromDescriptor(CoreContainer.java:1590)~[?:?] atorg.apache.solr.core.CoreContainer.lambda$load$12(CoreContainer.java:980)~[?:?] atcom.codahale.metrics.InstrumentedExecutorService$InstrumentedCallable.call(InstrumentedExecutorService.java:202)~[metrics-core-4.1.5.jar:4.1.5]

    ... 5 more
Caused by: java.lang.NoClassDefFoundError: org/objectweb/asm/util/Printer

atorg.openjdk.nashorn.internal.codegen.Compiler.createCompileUnit(Compiler.java:766)~[?:?] atorg.openjdk.nashorn.internal.codegen.Compiler.createCompileUnit(Compiler.java:774)~[?:?] atorg.openjdk.nashorn.internal.codegen.Compiler.addCompileUnit(Compiler.java:759)~[?:?] atorg.openjdk.nashorn.internal.codegen.CompilationPhase$SplittingPhase.transform(CompilationPhase.java:117)~[?:?] atorg.openjdk.nashorn.internal.codegen.CompilationPhase.apply(CompilationPhase.java:614)~[?:?] atorg.openjdk.nashorn.internal.codegen.Compiler.compile(Compiler.java:641)~[?:?] atorg.openjdk.nashorn.internal.runtime.Context.compile(Context.java:1531)~[?:?] atorg.openjdk.nashorn.internal.runtime.Context.compileScript(Context.java:1451)~[?:?] atorg.openjdk.nashorn.internal.runtime.Context.compileScript(Context.java:761)~[?:?] atorg.openjdk.nashorn.api.scripting.NashornScriptEngine.compileImpl(NashornScriptEngine.java:528)~[?:?] atorg.openjdk.nashorn.api.scripting.NashornScriptEngine.compileImpl(NashornScriptEngine.java:517)~[?:?] atorg.openjdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:395)~[?:?] atorg.openjdk.nashorn.api.scripting.NashornScriptEngine.eval(NashornScriptEngine.java:146)~[?:?] atjavax.script.AbstractScriptEngine.eval(AbstractScriptEngine.java:249)~[java.scripting:?] atorg.apache.solr.scripting.update.ScriptUpdateProcessorFactory$1.run(ScriptUpdateProcessorFactory.java:318)~[?:?] atorg.apache.solr.scripting.update.ScriptUpdateProcessorFactory$1.run(ScriptUpdateProcessorFactory.java:315)~[?:?]

    at java.security.AccessController.doPrivileged(Native Method) ~[?:?]

atorg.apache.solr.scripting.update.ScriptUpdateProcessorFactory.initEngines(ScriptUpdateProcessorFactory.java:314)~[?:?] atorg.apache.solr.scripting.update.ScriptUpdateProcessorFactory.inform(ScriptUpdateProcessorFactory.java:232)~[?:?] atorg.apache.solr.core.SolrResourceLoader.inform(SolrResourceLoader.java:728)~[?:?]

    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1154) ~[?:?]
    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1047) ~[?:?]

    ... 5 more
Caused by: java.lang.ClassNotFoundException: org.objectweb.asm.util.Printer
    at java.net.URLClassLoader.findClass(URLClassLoader.java:471) ~[?:?]
    at java.lang.ClassLoader.loadClass(ClassLoader.java:589) ~[?:?]

atjava.net.FactoryURLClassLoader.loadClass(URLClassLoader.java:899) ~[?:?]

    at java.lang.ClassLoader.loadClass(ClassLoader.java:522) ~[?:?]

    at java.security.AccessController.doPrivileged(Native Method) ~[?:?]

    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1154) ~[?:?]
    at org.apache.solr.core.SolrCore.<init>(SolrCore.java:1047) ~[?:?]

    ... 5 more

I would rather not disable the security manager to get things working,but I also don't know what is causing the above exceptions, so even if Idid this is not a readily viable alternative.

Thanks again for your suggestion, and looking forward to any other ideasyou or anyone else might have,


Alex


On 09/11/2023 15:55, Ishan Chattopadhyaya wrote:

You can disable the security manager, and it will work for you. Your
deployment will be vulnerable to security attacks, though, hence doing this
is not recommended.

On Thu, 9 Nov, 2023, 2:00 pm Alexandros Paramythis,
<alexandros.paramyt...@contexity.ch.invalid>  wrote:

Hi everyone

We are developing a new TokenFilter which, as part of the analysis of
tokens it performs, needs to make an "external" HTTP request. This
results in a AccessControlException due to missing
"java.net.SocketPermission". A relevant excerpt of the stacktrace:

Caused by: java.security.AccessControlException: access denied
("java.net.SocketPermission" "translation.googleapis.com:443"
"connect,resolve")
   at
java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)

~[?:?]
      at
java.security.AccessController.checkPermission(AccessController.java:897)
~[?:?]
      at
java.lang.SecurityManager.checkPermission(SecurityManager.java:322) ~[?:?]
      at java.lang.SecurityManager.checkConnect(SecurityManager.java:824)
~[?:?]
      at sun.net.www.http.HttpClient.openServer(HttpClient.java:552) ~[?:?]
      at
sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:265) ~[?:?]
      at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:372)
~[?:?]
      at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)

~[?:?]
      at
sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1187)

~[?:?]
      at
sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1081)

~[?:?]
      at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)

~[?:?]
      at
sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:168)

~[?:?]
      at
repackaged.com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:151)

~[?:?]
      at
repackaged.com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:84)

~[?:?]
      at
repackaged.com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1012)

~[?:?]
      at
repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:552)

~[?:?]
      at
repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:493)

~[?:?]
      at
repackaged.com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:603)

~[?:?]
      at
repackaged.com.google.cloud.translate.spi.v2.HttpTranslateRpc.translate(HttpTranslateRpc.java:112)

~[?:?]
      at
repackaged.com.google.cloud.translate.TranslateImpl$4.call(TranslateImpl.java:124)

~[?:?]
      at
repackaged.com.google.cloud.translate.TranslateImpl$4.call(TranslateImpl.java:121)

~[?:?]
      at
repackaged.com.google.api.gax.retrying.DirectRetryingExecutor.submit(DirectRetryingExecutor.java:103)

~[?:?]
      at repackaged.com.google.cloud.RetryHelper.run(RetryHelper.java:76)
~[?:?]
      at
repackaged.com.google.cloud.RetryHelper.runWithRetries(RetryHelper.java:50)

~[?:?]
      at
repackaged.com.google.cloud.translate.TranslateImpl.translate(TranslateImpl.java:120)

~[?:?]
      ... 17 more

What we have tried to address this problem without success:

   * Locating the jar file in different places: in a module dir, in the
     main lib dir of the installation, in the lib dir of a collection.
     The exception is the same in all cases.
   * Changing the security.policy file in solr/server/etc and adding
     permissions like this:
        permission java.net.SocketPermission
     "translation.googleapis.com", "connect,resolve";
        permission java.net.SocketPermission
     "translation.googleapis.com:443", "connect,resolve";
     For reference, we have tried all of the aforementioned locations of
     the jar file with both the original and the modified security.policy
     files.

Does anyone have any suggestions on what additional / different steps
are necessary to allow such calls?

Thanks in advance for any input or pointers to relevant documentation
that we may have missed!

Best regards,

Alex


--
*Dr. Alexandros Paramythis, M.Sc.*
CONTEXITY AG | Technoparkstrasse 2, CH-8406 Winterthur

*T* +41 78 611 6542 | *E* alexandros.paramyt...@contexity.ch | *W*www.contexity.ch <http://www.contexity.ch>

Re: SocketPermission exception when calling an external REST API from within a custom TokenFilter

Reply via email to