Skip to content

Commit e934e78

Browse files
reekitconceptreekitconcept
committed
Upgrade to Solr 9.10 with external Tika server (CVE-2025-66516 fix)
- Upgrade Solr from 8 to 9.10 - Add external Tika server (3.2.3) to mitigate CVE-2025-66516 - Update solrconfig.xml for Solr 9 compatibility (luceneMatchVersion 9.12) - Configure extraction handler to use external Tika server - Remove deprecated local Tika library loading - Add Makefile targets for solr-activate-and-reindex
1 parent 28eddca commit e934e78

File tree

8 files changed

+91
-32
lines changed

8 files changed

+91
-32
lines changed

‎Makefile‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,50 @@ stack-rm: ## Local Stack: Remove Services and Volumes
182182
@echo "Remove local volume data"
183183
@docker volume rm $(PROJECT_NAME)_vol-site-data
184184

185+
186+
###########################################
187+
# SOLR
188+
###########################################
189+
190+
BACKEND_FOLDER=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
191+
192+
SOLR_DATA_FOLDER?=${BACKEND_FOLDER}/data
193+
SOLR_ONLY_COMPOSE?=${BACKEND_FOLDER}/docker-compose.yml
194+
195+
## Solr docker utils
196+
test-compose-project-name:
197+
# The COMPOSE_PROJECT_NAME env variable must exist and discriminate between your projects,
198+
# and the purpose of the container (_DEV, _STACK, _TEST)
199+
test -n "$(PROJECT_NAME)"
200+
201+
.PHONY: solr-start
202+
solr-start: test-compose-project-name ## Start solr
203+
@echo "Start solr"
204+
@COMPOSE_PROJECT_NAME=${PROJECT_NAME} docker compose -f ${STACK_FILE} up -d solr
205+
206+
.PHONY: solr-start-fg
207+
solr-start-fg: test-compose-project-name ## Start solr in foreground
208+
@echo "Start solr in foreground"
209+
@COMPOSE_PROJECT_NAME=${PROJECT_NAME} docker compose -f ${STACK_FILE} up solr
210+
211+
.PHONY: solr-stop
212+
solr-stop: test-compose-project-name ## Stop solr
213+
@echo "Stop solr"
214+
@COMPOSE_PROJECT_NAME=${PROJECT_NAME} docker compose -f ${STACK_FILE} down solr
215+
216+
.PHONY: solr-logs
217+
solr-logs: test-compose-project-name ## Show solr logs
218+
@echo "Show solr logs"
219+
@COMPOSE_PROJECT_NAME=${PROJECT_NAME} docker compose -f ${STACK_FILE} logs -f solr
220+
221+
.PHONY: solr-activate-and-reindex
222+
solr-activate-and-reindex: ## Activate solr and reindex content
223+
$(MAKE) -C "./backend/" solr-activate-and-reindex
224+
225+
.PHONY: solr-activate-and-reindex-clear
226+
solr-activate-and-reindex-clear: ## Activate solr and reindex content with clear
227+
$(MAKE) -C "./backend/" solr-activate-and-reindex-clear
228+
185229
###########################################
186230
# Acceptance
187231
###########################################

‎backend/Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,14 @@ console: $(VENV_FOLDER) instance/etc/zope.ini ## Start a console into a Plone in
9494
create-site: $(VENV_FOLDER) instance/etc/zope.ini ## Create a new site from scratch
9595
@$(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/create_site.py
9696

97+
.PHONY: solr-activate-and-reindex
98+
solr-activate-and-reindex: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content
99+
PYTHONWARNINGS=ignore @$(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py
100+
101+
.PHONY: solr-activate-and-reindex-clear
102+
solr-activate-and-reindex-clear: $(VENV_FOLDER) instance/etc/zope.ini ## Activate solr and reindex content with clear
103+
PYTHONWARNINGS=ignore @$(BIN_FOLDER)/zconsole run instance/etc/zope.conf ./scripts/solr_activate_and_reindex.py --clear
104+
97105
# Example Content
98106
.PHONY: update-example-content
99107
update-example-content: $(VENV_FOLDER) ## Export example content inside package

‎docker-compose-ci.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,27 @@ name: kitconcept-solr-ci
77

88
services:
99

10+
tika-acceptance:
11+
image: apache/tika:3.2.3.0-full
12+
profiles: ["ci"]
13+
ports:
14+
- 9998:9998
15+
1016
solr-acceptance:
1117
build:
1218
context: ./solr
1319
profiles: ["ci"]
20+
depends_on:
21+
- tika-acceptance
1422
ports:
1523
- 8983:8983
1624
command:
1725
- solr-precreate
1826
- plone
1927
- /plone-config
28+
environment:
29+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998 -Dsolr.config.lib.enabled=true"
30+
2031
frontend-acceptance:
2132
image: ghcr.io/kitconcept/kitconcept-solr-frontend:${BASE_TAG}
2233
pull_policy: always

‎docker-compose-dev.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,27 @@ name: kitconcept-solr-acceptance
33

44
services:
55

6+
tika-acceptance:
7+
image: apache/tika:3.2.3.0-full
8+
profiles: ["acceptance", "dev", "solr"]
9+
ports:
10+
- 9998:9998
11+
612
solr-acceptance:
713
build:
814
context: ./solr
915
pull_policy: build
1016
profiles: ["acceptance", "dev", "solr"]
17+
depends_on:
18+
- tika-acceptance
1119
ports:
1220
- 8983:8983
1321
command:
1422
- solr-precreate
1523
- plone
1624
- /plone-config
25+
environment:
26+
SOLR_OPTS: "-Dsolr.tika.url=http://tika-acceptance:9998 -Dsolr.config.lib.enabled=true"
1727

1828
frontend: &frontend
1929
build:

‎docker-compose.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,16 +98,24 @@ services:
9898
- traefik.http.routers.rt-backend-classic.service=svc-backend
9999
- traefik.http.routers.rt-backend-classic.middlewares=gzip,mw-backend-auth,mw-backend-vhm-classic
100100

101+
tika:
102+
image: apache/tika:3.2.3.0-full
103+
ports:
104+
- 9998:9998
105+
101106
solr:
102107
build:
103108
context: solr/
104109
ports:
105110
- 8983:8983
111+
depends_on:
112+
- tika
106113
command:
107114
- solr-precreate
108115
- plone
109116
- /plone-config
110-
117+
environment:
118+
SOLR_OPTS: "-Dsolr.tika.url=http://tika:9998 -Dsolr.config.lib.enabled=true"
111119

112120
volumes:
113121
vol-site-data: {}

‎news/+fix-tikka-sec-vulnerability.bugfix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Upgrade to Solr 9.10 with external Tika server 3.2.3 to fix CVE-2025-66516. @reebalazs

‎solr/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# syntax=docker/dockerfile:1
2-
FROM solr:8
2+
FROM solr:9.10
33

44
LABEL maintainer="kitconcept, GmbH <[email protected]>" \
55
org.label-schema.name="ghcr.io/kitconcept/solr" \
6-
org.label-schema.description="Solr 8 image with Plone default settings" \
6+
org.label-schema.description="Solr 9 image with Plone default settings" \
77
org.label-schema.vendor="kitconcept, GmbH"
88

99
# Copy default plone configuration for this image

‎solr/etc/conf/solrconfig.xml‎

Lines changed: 6 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<config>
3-
<luceneMatchVersion>4.5</luceneMatchVersion>
3+
<luceneMatchVersion>9.12</luceneMatchVersion>
44

55
<dataDir>${solr.data.dir:}</dataDir>
66

@@ -11,33 +11,6 @@
1111
<codecFactory class="solr.SchemaCodecFactory" />
1212
<schemaFactory class="ClassicIndexSchemaFactory" />
1313

14-
<!-- TIKA START -->
15-
<!-- Load Data Import Handler and Apache Tika (extraction) libraries -->
16-
<lib dir="${solr.install.dir:../../../..}/dist/"
17-
regex="solr-dataimporthandler-.*\.jar"
18-
/>
19-
20-
<lib dir="${solr.install.dir:../../../..}/contrib/extraction/lib"
21-
regex=".*\.jar"
22-
/>
23-
<lib dir="${solr.install.dir:../../../..}/dist/"
24-
regex="solr-cell-\d.*\.jar"
25-
/>
26-
27-
<lib dir="${solr.install.dir:../../../..}/contrib/langid/lib/"
28-
regex=".*\.jar"
29-
/>
30-
<lib dir="${solr.install.dir:../../../..}/dist/"
31-
regex="solr-langid-\d.*\.jar"
32-
/>
33-
34-
<lib dir="${solr.install.dir:../../../..}/contrib/velocity/lib"
35-
regex=".*\.jar"
36-
/>
37-
<lib dir="${solr.install.dir:../../../..}/dist/"
38-
regex="solr-velocity-\d.*\.jar"
39-
/>
40-
4114
<!-- Request Dispatcher
4215
This section contains instructions for how the SolrDispatchFilter
4316
should behave when processing requests for this SolrCore.
@@ -118,11 +91,16 @@
11891

11992
<!-- Solr Cell Update Request Handler
12093
http://wiki.apache.org/solr/ExtractingRequestHandler
94+
Uses external Tika server for document parsing (CVE-2025-66516 mitigation)
12195
-->
12296
<requestHandler class="solr.extraction.ExtractingRequestHandler"
12397
name="/update/extract"
12498
startup="lazy"
12599
>
100+
<!-- Use external Tika server instead of local (deprecated) backend -->
101+
<str name="extraction.backend">tikaserver</str>
102+
<str name="tikaserver.url">${solr.tika.url:http://tika:9998}</str>
103+
126104
<lst name="defaults">
127105
<str name="lowernames">true</str>
128106
<str name="uprefix">ignored_</str>
@@ -133,7 +111,6 @@
133111
<str name="fmap.div">ignored_</str>
134112
</lst>
135113
</requestHandler>
136-
<!-- TIKA END -->
137114

138115
<!-- The default high-performance update handler -->
139116
<updateHandler class="solr.DirectUpdateHandler2">

0 commit comments

Comments
 (0)