jbonofre opened a new pull request, #2863: URL: https://github.com/apache/karaf/pull/2863
## Problem The `jdbc` and `jms` command scopes ship no `org.apache.karaf.command.acl.*` configuration. Karaf's command guard treats a command with no matching ACL entry as **allowed**, so any authenticated shell user — `viewer` role included — can run every `jdbc:*` and `jms:*` command. `jdbc:ds-create` / `jms:create` store a user-supplied URL into a pax-jdbc-config / pax-jms-config factory configuration that is turned into a live `DataSource` / `ConnectionFactory`. Several JDBC drivers execute code at connection time based on URL parameters (for instance H2 `INIT=RUNSCRIPT`), making datasource creation equivalent to arbitrary code execution. `jdbc:execute` / `jdbc:query` run arbitrary SQL, and `jms:send` / `jms:consume` / `jms:move` write to or destructively drain broker destinations. This is the same class of gap as #2861 / #2862 (`config:install`), and lets a low-privilege user bypass the `admin` requirement that already protects `shell:exec`. ## Fix Add an ACL for each scope, provided by the `jdbc` / `jms` feature via a `<config>` element under a `shell` conditional (same mechanism as the `kar` and `maven` scopes): | scope | admin | viewer | |---|---|---| | `jdbc` | `ds-create`, `ds-delete`, `execute`, `query` | `ds-list`, `ds-info`, `ds-factories`, `tables` | | `jms` | `create`, `delete`, `send`, `consume`, `move` | `connectionfactories`, `info`, `queues`, `topics`, `count`, `browse` | Consistent with `shell:exec` and `config:install`, already restricted to `admin`. ## Notes - The JMX side is already covered by the generic `etc/jmx.acl.cfg` (`* = admin`). - No URL blocklist is added: it is trivially bypassable and `INIT` etc. can be legitimate for an admin. The ACL is the trust boundary. ## Tests - `JdbcSshCommandSecurityTest` and `JmsSshCommandSecurityTest` — verify a viewer and a manager cannot see the admin-only commands while `karaf` can, over SSH. - Manual updated (`user-guide/security.adoc`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
