[
https://issues.apache.org/jira/browse/TINKERPOP-2583?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Stephen Mallette updated TINKERPOP-2583:
----------------------------------------
Description:
Make it so that gremlin-groovy is an opt-in bit of functionality for Gremlin
Server and by default instead rely on traversals generated from
gremlin-language as implemented in TINKERPOP-2582. In this way, we have a
secure Gremlin Server by default.
One of the problems with disabling gremlin-groovy processing is that we require
it for the init script to the server. Without that, we have no mechanism that
allows configuration of "g" and other important bits. It could be that we need
to retain gremlin-groovy for that purpose and just prevent it from being called
externally. Not sure that's so good though because removing Groovy more wholly
would be nice given TINKERPOP-2526
was:Make it so that gremlin-groovy is an opt-in bit of functionality for
Gremlin Server and by default instead rely on traversals generated from
gremlin-language as implemented in TINKERPOP-2582. In this way, we have a
secure Gremlin Server by default.
> Make gremlin-groovy processing optional in Gremlin Server
> ---------------------------------------------------------
>
> Key: TINKERPOP-2583
> URL: https://issues.apache.org/jira/browse/TINKERPOP-2583
> Project: TinkerPop
> Issue Type: Improvement
> Components: server
> Affects Versions: 3.6.0
> Reporter: Stephen Mallette
> Assignee: Stephen Mallette
> Priority: Blocker
>
> Make it so that gremlin-groovy is an opt-in bit of functionality for Gremlin
> Server and by default instead rely on traversals generated from
> gremlin-language as implemented in TINKERPOP-2582. In this way, we have a
> secure Gremlin Server by default.
> One of the problems with disabling gremlin-groovy processing is that we
> require it for the init script to the server. Without that, we have no
> mechanism that allows configuration of "g" and other important bits. It could
> be that we need to retain gremlin-groovy for that purpose and just prevent it
> from being called externally. Not sure that's so good though because removing
> Groovy more wholly would be nice given TINKERPOP-2526
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
