Skip to content

Commit fc2a225

Browse files
epughepugh
authored
SOLR-17864: Use modern format for allow urls and allow paths (#3813)
* Migrate solr.allowPaths to solr.security.allow.paths * Migrate solr.allowUrls to solr.security.allow.urls * add properties to the ref guide
1 parent ab20e85 commit fc2a225

File tree

30 files changed

+74
-56
lines changed

30 files changed

+74
-56
lines changed

‎changelog/unreleased/SOLR_17864_part_trece.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# See https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc
2+
title: Migrated system properties solr.allowPaths and solr.allowUrls to modern equivalents.
3+
type: changed # added, changed, fixed, deprecated, removed, dependency_update, security, other
4+
authors:
5+
- name: Eric Pugh
6+
links:
7+
- name: SOLR-17864
8+
url: https://issues.apache.org/jira/browse/SOLR-17864
9+
issues:
10+
- 17864

‎gradle/testing/randomization/policies/solr-tests.policy‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,8 +231,8 @@ grant {
231231
permission java.io.FilePermission "${solr.logs.dir}", "read,write,delete,readlink";
232232
permission java.io.FilePermission "${solr.logs.dir}${/}-", "read,write,delete,readlink";
233233

234-
permission java.io.FilePermission "${solr.allowPaths}", "read,write,delete,readlink";
235-
permission java.io.FilePermission "${solr.allowPaths}${/}-", "read,write,delete,readlink";
234+
permission java.io.FilePermission "${solr.security.allow.paths}", "read,write,delete,readlink";
235+
permission java.io.FilePermission "${solr.security.allow.paths}${/}-", "read,write,delete,readlink";
236236

237237
permission java.io.FilePermission "${log4j.configurationFile}", "read,write,delete,readlink";
238238

‎solr/benchmark/src/resources/solr.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@
2626
<str name="shareSchema">${shareSchema:false}</str>
2727
<str name="configSetBaseDir">${configSetBaseDir:configsets}</str>
2828
<str name="coreRootDirectory">${coreRootDirectory:.}</str>
29-
<str name="allowPaths">${solr.allowPaths:}</str>
30-
<str name="allowUrls">${solr.tests.allowUrls:}</str>
29+
<str name="allowPaths">${solr.security.allow.paths:}</str>
30+
<str name="allowUrls">${solr.tests.security.allow.urls:}</str>
3131

3232
<shardHandlerFactory name="shardHandlerFactory" class="HttpShardHandlerFactory">
3333
<str name="urlScheme">${urlScheme:}</str>

‎solr/bin/solr.in.cmd‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -201,9 +201,9 @@ REM set SOLR_GZIP_ENABLED=true
201201

202202
REM When running Solr in non-cloud mode and if planning to do distributed search (using the "shards" parameter), the
203203
REM list of hosts needs to be defined in an allow-list or Solr will forbid the request. The allow-list can be configured
204-
REM in solr.xml, or if you are using the OOTB solr.xml, can be specified using the system property "solr.allowUrls".
204+
REM in solr.xml, or if you are using the OOTB solr.xml, can be specified using the system property "solr.security.allow.urls".
205205
REM Alternatively host checking can be disabled by setting the system property "solr.security.allow.urls.enabled=false"
206-
REM set SOLR_OPTS=%SOLR_OPTS% -Dsolr.allowUrls=http://localhost:8983,http://localhost:8984
206+
REM set SOLR_OPTS=%SOLR_OPTS% -Dsolr.security.allow.urls=http://localhost:8983,http://localhost:8984
207207

208208
REM For a visual indication in the Admin UI of what type of environment this cluster is, configure
209209
REM a -Dsolr.environment property below. Valid values are prod, stage, test, dev, with an optional
@@ -234,7 +234,7 @@ REM set SOLR_UI_EXPERIMENTAL_ENABLED=false
234234
REM Solr is by default allowed to read and write data from/to SOLR_HOME and a few other well defined locations
235235
REM Sometimes it may be necessary to place a core or a backup on a different location or a different disk
236236
REM This parameter lets you specify file system path(s) to explicitly allow. The special value of '*' will allow any path
237-
REM set SOLR_OPTS=%SOLR_OPTS% -Dsolr.allowPaths=D:\,E:\other\path
237+
REM set SOLR_OPTS=%SOLR_OPTS% -Dsolr.security.allow.paths=D:\,E:\other\path
238238

239239
REM Before version 9.0, Solr required a copy of solr.xml file in $SOLR_HOME. Now Solr will use a default file if not found.
240240
REM To restore the old behavior, set the variable below to true

‎solr/bin/solr.in.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -227,9 +227,9 @@
227227

228228
# When running Solr in non-cloud mode and if planning to do distributed search (using the "shards" parameter), the
229229
# list of hosts needs to be defined in an allow-list or Solr will forbid the request. The allow-list can be configured
230-
# in solr.xml, or if you are using the OOTB solr.xml, can be specified using the system property "solr.allowUrls".
230+
# in solr.xml, or if you are using the OOTB solr.xml, can be specified using the system property "solr.security.allow.urls".
231231
# Alternatively host checking can be disabled by setting the system property "solr.security.allow.urls.enabled=false"
232-
#SOLR_OPTS="$SOLR_OPTS -Dsolr.allowUrls=http://localhost:8983,http://localhost:8984"
232+
#SOLR_OPTS="$SOLR_OPTS -Dsolr.security.allow.urls=http://localhost:8983,http://localhost:8984"
233233

234234
# For a visual indication in the Admin UI of what type of environment this cluster is, configure
235235
# a -Dsolr.environment property below. Valid values are prod, stage, test, dev, with an optional
@@ -260,7 +260,7 @@
260260
# Solr is by default allowed to read and write data from/to SOLR_HOME and a few other well defined locations
261261
# Sometimes it may be necessary to place a core or a backup on a different location or a different disk
262262
# This parameter lets you specify file system path(s) to explicitly allow. The special value of '*' will allow any path
263-
#SOLR_OPTS="$SOLR_OPTS -Dsolr.allowPaths=/mnt/bigdisk,/other/path"
263+
#SOLR_OPTS="$SOLR_OPTS -Dsolr.security.allow.paths=/mnt/bigdisk,/other/path"
264264

265265
# Solr can attempt to take a heap dump on out of memory errors. To enable this, uncomment the line setting
266266
# SOLR_HEAP_DUMP below. Heap dumps will be saved to SOLR_LOG_DIR/dumps by default. Alternatively, you can specify any

‎solr/core/src/java/org/apache/solr/core/SolrPaths.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ public static void assertPathAllowed(Path pathToAssert, Set<Path> allowPaths)
7878
SolrException.ErrorCode.BAD_REQUEST,
7979
"Path "
8080
+ path
81-
+ " must be relative to SOLR_HOME, SOLR_DATA_HOME coreRootDirectory. Set system property 'solr.allowPaths' to add other allowed paths.");
81+
+ " must be relative to SOLR_HOME, SOLR_DATA_HOME coreRootDirectory. Set system property 'solr.security.allow.paths' to add other allowed paths.");
8282
}
8383
}
8484

‎solr/core/src/test-files/solr/solr-50-all.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
<str name="configSetsHandler">testConfigSetsHandler</str>
2525
<str name="managementPath">testManagementPath</str>
2626
<str name="sharedLib">testSharedLib</str>
27-
<str name="allowPaths">${solr.allowPaths:}</str>
27+
<str name="allowPaths">${solr.security.allow.paths:}</str>
2828
<str name="shareSchema">${shareSchema:true}</str>
2929
<str name="coresLocator">testCoresLocator</str>
3030
<str name="coreSorter">testCoreSorter</str>

‎solr/core/src/test-files/solr/solr.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@
2626
<str name="shareSchema">${shareSchema:false}</str>
2727
<str name="configSetBaseDir">${configSetBaseDir:configsets}</str>
2828
<str name="coreRootDirectory">${coreRootDirectory:.}</str>
29-
<str name="allowPaths">${solr.allowPaths:}</str>
30-
<str name="allowUrls">${solr.tests.allowUrls:}</str>
29+
<str name="allowPaths">${solr.security.allow.paths:}</str>
30+
<str name="allowUrls">${solr.tests.security.allow.urls:}</str>
3131
<bool name="hideStackTrace">${solr.hideStackTrace:true}</bool>
3232
<int name="indexSearcherExecutorThreads">4</int>
3333

‎solr/core/src/test/org/apache/solr/cloud/api/collections/BackupRestoreApiErrorConditionsTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ public class BackupRestoreApiErrorConditionsTest extends SolrCloudTestCase {
4646
*/
4747
@BeforeClass
4848
public static void setUpClass() throws Exception {
49-
System.setProperty("solr.allowPaths", "*");
49+
System.setProperty("solr.security.allow.paths", "*");
5050
validBackupLocation = createTempDir().toAbsolutePath().toString();
5151

5252
String solrXml = MiniSolrCloudCluster.DEFAULT_CLOUD_SOLR_XML;
@@ -78,7 +78,7 @@ public static void setUpClass() throws Exception {
7878

7979
@AfterClass
8080
public static void tearDownClass() {
81-
System.clearProperty("solr.allowPaths");
81+
System.clearProperty("solr.security.allow.paths");
8282
}
8383

8484
@Test

‎solr/core/src/test/org/apache/solr/core/TestCoreContainer.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,7 @@ public void testSolrInstallDir() throws Exception {
506506
private static final String ALLOW_PATHS_SOLR_XML =
507507
"<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n"
508508
+ "<solr>\n"
509-
+ "<str name=\"allowPaths\">${solr.allowPaths:}</str>\n"
509+
+ "<str name=\"allowPaths\">${solr.security.allow.paths:}</str>\n"
510510
+ "</solr>";
511511

512512
private static final String CUSTOM_HANDLERS_SOLR_XML =
@@ -630,7 +630,7 @@ public CustomConfigSetsHandler(CoreContainer cc) {
630630
@Test
631631
public void assertAllowPathFromSolrXml() throws Exception {
632632
Assume.assumeFalse(OS.isFamilyWindows());
633-
System.setProperty("solr.allowPaths", "/var/solr");
633+
System.setProperty("solr.security.allow.paths", "/var/solr");
634634
CoreContainer cc = init(ALLOW_PATHS_SOLR_XML);
635635
cc.assertPathAllowed(Path.of("/var/solr/foo"));
636636
try {
@@ -640,14 +640,14 @@ public void assertAllowPathFromSolrXml() throws Exception {
640640
/* Ignore */
641641
} finally {
642642
cc.shutdown();
643-
System.clearProperty("solr.allowPaths");
643+
System.clearProperty("solr.security.allow.paths");
644644
}
645645
}
646646

647647
@Test
648648
public void assertAllowPathFromSolrXmlWin() throws Exception {
649649
Assume.assumeTrue(OS.isFamilyWindows());
650-
System.setProperty("solr.allowPaths", "C:\\solr");
650+
System.setProperty("solr.security.allow.paths", "C:\\solr");
651651
CoreContainer cc = init(ALLOW_PATHS_SOLR_XML);
652652
cc.assertPathAllowed(Path.of("C:\\solr\\foo"));
653653
try {
@@ -657,7 +657,7 @@ public void assertAllowPathFromSolrXmlWin() throws Exception {
657657
/* Ignore */
658658
} finally {
659659
cc.shutdown();
660-
System.clearProperty("solr.allowPaths");
660+
System.clearProperty("solr.security.allow.paths");
661661
}
662662
}
663663

@@ -691,7 +691,7 @@ public void assertAllowPathWindows() {
691691
@Test
692692
public void assertAllowPathNormalization() throws Exception {
693693
Assume.assumeFalse(OS.isFamilyWindows());
694-
System.setProperty("solr.allowPaths", "/var/solr/../solr");
694+
System.setProperty("solr.security.allow.paths", "/var/solr/../solr");
695695
CoreContainer cc = init(ALLOW_PATHS_SOLR_XML);
696696
cc.assertPathAllowed(Path.of("/var/solr/foo"));
697697
assertThrows(
@@ -701,13 +701,13 @@ public void assertAllowPathNormalization() throws Exception {
701701
cc.assertPathAllowed(Path.of("/tmp"));
702702
});
703703
cc.shutdown();
704-
System.clearProperty("solr.allowPaths");
704+
System.clearProperty("solr.security.allow.paths");
705705
}
706706

707707
@Test
708708
public void assertAllowPathNormalizationWin() throws Exception {
709709
Assume.assumeTrue(OS.isFamilyWindows());
710-
System.setProperty("solr.allowPaths", "C:\\solr\\..\\solr");
710+
System.setProperty("solr.security.allow.paths", "C:\\solr\\..\\solr");
711711
CoreContainer cc = init(ALLOW_PATHS_SOLR_XML);
712712
cc.assertPathAllowed(Path.of("C:\\solr\\foo"));
713713
assertThrows(
@@ -717,7 +717,7 @@ public void assertAllowPathNormalizationWin() throws Exception {
717717
cc.assertPathAllowed(Path.of("C:\\tmp"));
718718
});
719719
cc.shutdown();
720-
System.clearProperty("solr.allowPaths");
720+
System.clearProperty("solr.security.allow.paths");
721721
}
722722

723723
private static Set<Path> ALLOWED_PATHS = Set.of(Path.of("/var/solr"));

0 commit comments

Comments
 (0)