Skip to content

Commit 6e2272c

Browse files
dsmileyjanhoy
authored and
Ishan Chattopadhyaya
committed
SOLR-14853: enableRemoteStreaming and enableStreamBody are now global (#1615)
Env vars: SOLR_ENABLE_REMOTE_STREAMING and SOLR_ENABLE_STREAM_BODY Sys props: solr.enableRemoteStreaming and solr.enableStreamBody solrconfig.xml (including via config-edit API) are now no-op; log a warning. Backwards incompatible but easy to comply. Co-authored-by: Jan Høydahl <janhoy@users.noreply.github.com> --------- Signed-off-by: Jan Høydahl <janhoy@users.noreply.github.com> Co-authored-by: Jan Høydahl <janhoy@users.noreply.github.com>
1 parent 7bd8229 commit 6e2272c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+115
-81
lines changed

‎solr/CHANGES.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,9 @@ Other Changes
5050

5151
* SOLR-17025: Upgrade Jetty to 9.4.53.v20231009 (Kevin Risden)
5252

53+
* SOLR-14853: Security: Converted enableRemoteStreaming and enableStreamBody solrconfig options into system properties and env vars.
54+
Attempts to set them the old way are no-op and log a warning. (David Smiley, janhoy, Ishan Chattopadhyaya)
55+
5356
================== 8.11.2 ==================
5457

5558
Consult the LUCENE_CHANGES.txt file for additional, low level, changes in this release.

‎solr/core/src/java/org/apache/solr/core/SolrConfig.java

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,6 @@ public enum PluginOpts {
134134

135135
private int formUploadLimitKB;
136136

137-
private boolean enableRemoteStreams;
138-
private boolean enableStreamBody;
139-
140137
private boolean handleSelect;
141138

142139
private boolean addHttpRequestToContext;
@@ -340,9 +337,13 @@ private SolrConfig(SolrResourceLoader loader, String name, boolean isConfigsetTr
340337
formUploadLimitKB = get("requestDispatcher").get("requestParsers").intAttr("formdataUploadLimitInKB", Integer.MAX_VALUE);
341338
if (formUploadLimitKB == -1) formUploadLimitKB = Integer.MAX_VALUE;
342339

343-
enableRemoteStreams = get("requestDispatcher").get("requestParsers").boolAttr("enableRemoteStreaming", false);
340+
if (get("requestDispatcher").get("requestParsers").attr("enableRemoteStreaming") != null) {
341+
log.warn("Ignored deprecated enableRemoteStreaming in config; use sys-prop");
342+
}
344343

345-
enableStreamBody = get("requestDispatcher").get("requestParsers").boolAttr("enableStreamBody", false);
344+
if (get("requestDispatcher").get("requestParsers").attr("enableStreamBody") != null) {
345+
log.warn("Ignored deprecated enableStreamBody in config; use sys-prop");
346+
}
346347

347348
handleSelect = get("requestDispatcher").boolAttr("handleSelect", !luceneMatchVersion.onOrAfter(Version.LUCENE_7_0_0));
348349
addHttpRequestToContext = get("requestDispatcher").get("requestParsers").boolAttr("addHttpRequestToContext", false);
@@ -902,15 +903,6 @@ public boolean isAddHttpRequestToContext() {
902903
return addHttpRequestToContext;
903904
}
904905

905-
public boolean isEnableRemoteStreams() {
906-
return enableRemoteStreams;
907-
}
908-
909-
public boolean isEnableStreamBody() {
910-
return enableStreamBody;
911-
}
912-
913-
914906
@Override
915907
@SuppressWarnings({"unchecked", "rawtypes"})
916908
public Map<String, Object> toMap(Map<String, Object> result) {

‎solr/core/src/java/org/apache/solr/handler/DumpRequestHandler.java

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import java.io.IOException;
2020
import java.io.Reader;
21+
import java.lang.invoke.MethodHandles;
2122
import java.util.ArrayList;
2223
import java.util.LinkedHashMap;
2324
import java.util.List;
@@ -28,14 +29,27 @@
2829
import org.apache.solr.common.util.NamedList;
2930
import org.apache.solr.common.util.SimpleOrderedMap;
3031
import org.apache.solr.core.PluginInfo;
32+
import org.apache.solr.core.SolrCore;
3133
import org.apache.solr.request.SolrQueryRequest;
3234
import org.apache.solr.request.SolrRequestHandler;
3335
import org.apache.solr.response.SolrQueryResponse;
36+
import org.apache.solr.security.AuthorizationContext;
37+
import org.apache.solr.security.PermissionNameProvider;
38+
import org.apache.solr.util.plugin.SolrCoreAware;
39+
import org.slf4j.Logger;
40+
import org.slf4j.LoggerFactory;
3441

3542
import static org.apache.solr.common.params.CommonParams.NAME;
3643

37-
public class DumpRequestHandler extends RequestHandlerBase
44+
public class DumpRequestHandler extends RequestHandlerBase implements SolrCoreAware, PermissionNameProvider
3845
{
46+
private static final Logger log = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
47+
SolrCore solrCore;
48+
49+
@Override
50+
public void inform(SolrCore core) {
51+
this.solrCore = core;
52+
}
3953

4054
@Override
4155
@SuppressWarnings({"unchecked"})
@@ -130,4 +144,15 @@ public void init(@SuppressWarnings({"rawtypes"})NamedList args) {
130144
if(nl!=null) subpaths = nl.getAll("subpath");
131145
}
132146
}
147+
148+
@Override
149+
public PermissionNameProvider.Name getPermissionName(AuthorizationContext request) {
150+
if (solrCore != null && solrCore.getSolrConfig().getRequestParsers().isEnableRemoteStreams()) {
151+
log.warn(
152+
"Dump request handler requires config-read permission when remote streams are enabled");
153+
return PermissionNameProvider.Name.CONFIG_READ_PERM;
154+
} else {
155+
return PermissionNameProvider.Name.ALL;
156+
}
157+
}
133158
}

‎solr/core/src/java/org/apache/solr/servlet/SolrRequestParsers.java

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -116,10 +116,11 @@ public SolrRequestParsers( SolrConfig globalConfig ) {
116116
multipartUploadLimitKB = globalConfig.getMultipartUploadLimitKB();
117117

118118
formUploadLimitKB = globalConfig.getFormUploadLimitKB();
119-
120-
enableRemoteStreams = globalConfig.isEnableRemoteStreams();
121-
enableStreamBody = globalConfig.isEnableStreamBody();
122-
119+
120+
// security risks; disabled by default
121+
enableRemoteStreams = Boolean.getBoolean("solr.enableRemoteStreaming");
122+
enableStreamBody = Boolean.getBoolean("solr.enableStreamBody");
123+
123124
// Let this filter take care of /select?xxx format
124125
handleSelect = globalConfig.isHandleSelect();
125126

@@ -482,8 +483,12 @@ public void setAddRequestHeadersToContext(boolean addRequestHeadersToContext) {
482483
this.addHttpRequestToContext = addRequestHeadersToContext;
483484
}
484485

485-
//-----------------------------------------------------------------
486-
//-----------------------------------------------------------------
486+
public boolean isEnableRemoteStreams() {
487+
return enableRemoteStreams;
488+
}
489+
490+
// -----------------------------------------------------------------
491+
// -----------------------------------------------------------------
487492

488493
// I guess we don't really even need the interface, but i'll keep it here just for kicks
489494
interface SolrRequestParser

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-analytics-query.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ based HashBitset. -->
216216
</searchComponent>
217217

218218
<requestDispatcher>
219-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
219+
<requestParsers multipartUploadLimitInKB="-1" />
220220
<httpCaching lastModifiedFrom="openTime" etagSeed="Solr" never304="false">
221221
<cacheControl>max-age=30, public</cacheControl>
222222
</httpCaching>

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-collapseqparser.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ based HashBitset. -->
218218
</requestHandler>
219219

220220
<requestDispatcher>
221-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
221+
<requestParsers multipartUploadLimitInKB="-1" />
222222
<httpCaching lastModifiedFrom="openTime" etagSeed="Solr" never304="false">
223223
<cacheControl>max-age=30, public</cacheControl>
224224
</httpCaching>

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-components-name.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
</requestHandler>
5454

5555
<requestDispatcher>
56-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
56+
<requestParsers multipartUploadLimitInKB="-1" />
5757
<httpCaching lastModifiedFrom="openTime" etagSeed="Solr" never304="false">
5858
<cacheControl>max-age=30, public</cacheControl>
5959
</httpCaching>

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-delaying-component.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
</requestHandler>
3636

3737
<requestDispatcher >
38-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
38+
<requestParsers multipartUploadLimitInKB="-1" />
3939
<httpCaching never304="true" />
4040
</requestDispatcher>
4141

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-doctransformers.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
<requestHandler name="/select" class="solr.SearchHandler"/>
4141

4242
<requestDispatcher>
43-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
43+
<requestParsers multipartUploadLimitInKB="-1" />
4444
</requestDispatcher>
4545

4646
<!-- config for the admin interface -->

‎solr/core/src/test-files/solr/collection1/conf/solrconfig-elevate.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@
128128
</requestHandler>-->
129129

130130
<requestDispatcher>
131-
<requestParsers enableRemoteStreaming="false" multipartUploadLimitInKB="-1" />
131+
<requestParsers multipartUploadLimitInKB="-1" />
132132
<httpCaching lastModifiedFrom="openTime" etagSeed="Solr" never304="false">
133133
<cacheControl>max-age=30, public</cacheControl>
134134
</httpCaching>

0 commit comments

Comments
 (0)