SOLR-15051 Blob, DRAFT WIP #20
Conversation
|
|
||
| /** | ||
| * An {@link InputStream} which wraps an {@link IndexInput}. Exact copy of {@code | ||
| * org.apache.lucene.replicator.IndexInputInputStream}. |
There was a problem hiding this comment.
It'd be good to get this into Lucene-core somewhere so we don't have to duplicate it.
bruno-roustant
force-pushed
the
jira/solr-15051-blob
branch
from
139d2a3
to
fcecdb6
Compare
bruno-roustant
force-pushed
the
jira/solr-15051-blob
branch
from
4b4ba12
to
13a4eeb
Compare
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| } | ||
|
|
||
| private MMapDirectory createMMapDirectory(String path, LockFactory lockFactory) throws IOException { | ||
| MMapDirectory mapDirectory = new MMapDirectory(new File(path).toPath(), lockFactory, mMapParams.maxChunk); |
There was a problem hiding this comment.
PATH_TRAVERSAL_IN: This API (java/io/File.(Ljava/lang/String;)V) reads a file whose location might be specified by user input (details)
(at-me in a reply with help or ignore)
There was a problem hiding this comment.
I've recorded this as ignored for this pull request. If you change your mind, just comment @muse-dev unignore.
Co-authored-by: Bruno Roustant <broustant@salesforce.com>
…and some refactoring. * Add BlobDirectoryFactoryTest and BlobDirectoryTest. * Add javadoc overview and package-info. * Clean BlobDirectoryFactory conf params, make BlobStore configurable, improve tests.
* BlobPusher: max threads, thread local stream buffer. * Synchronize internal collections in BlobDirectory
bruno-roustant
force-pushed
the
jira/solr-15051-blob
branch
from
13a4eeb
to
1e4642a
Compare
| @@ -0,0 +1,27 @@ | |||
| /* | |||
There was a problem hiding this comment.
Moderate OSS Vulnerability:
pkg:maven/com.google.guava/guava@25.1-jre
0 Critical, 0 Severe, 1 Moderate and 0 Unknown vulnerabilities have been found in a direct dependency
MODERATE Vulnerabilities (1)
[CVE-2020-8908] A temp directory creation vulnerability exists in all versions of Guava, allowin...
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.
CVSS Score: 3.3
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
(at-me in a reply with help or ignore)
|
+1 LGTM. But I don't think we want to merge to main; I think we want to stay on a branch. AFAIK BlobDirectory is merely unit tested, nothing more. |
https://issues.apache.org/jira/browse/SOLR-15051
Remember this is very WIP... just getting started here.
CC @bruno-roustant @NazerkeBS @atris