[ 
https://issues.apache.org/jira/browse/SOLR-16457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17630450#comment-17630450
 ] 

Kevin Risden commented on SOLR-16457:
-------------------------------------

attaching a patch [~elyograg] sent about using `pwd -P` to get canonical paths. 
Not tested yet but putting up here proactively:  [^fix_security_symlinks.patch] 

> solr.data.home should not be set to empty string in bin/solr
> ------------------------------------------------------------
>
>                 Key: SOLR-16457
>                 URL: https://issues.apache.org/jira/browse/SOLR-16457
>             Project: Solr
>          Issue Type: Bug
>      Security Level: Public(Default Security Level. Issues are Public) 
>          Components: cli
>    Affects Versions: 9.0, 9.1
>            Reporter: Kevin Risden
>            Assignee: Kevin Risden
>            Priority: Blocker
>             Fix For: main (10.0), 9.2
>
>         Attachments: fix_security_symlinks.patch
>
>          Time Spent: 3h
>  Remaining Estimate: 0h
>
> solr.data.home should not be set to empty string in bin/solr since that 
> causes the security.policy to be more wide open than it should. 
> solr.cmd does NOT have the same issue since it explicitly checks the case of 
> empty SOLR_DATA_HOME before adding it. 
> https://github.com/apache/solr/blob/main/solr/bin/solr.cmd#L1342



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org

Reply via email to