ctubbsii commented on code in PR #55: URL: https://github.com/apache/accumulo-classloaders/pull/55#discussion_r2747314402
########## modules/local-caching-classloader/README.md: ########## @@ -131,6 +131,17 @@ unexpected behavior to classloaders still using the file. * The local storage cache location **MUST** use a filesystem that supports atomic moves. +The Accumulo property `general.custom.classloader.lcc.allowed.urls.pattern` is +another required parameter, and is used to limit the allowed URLs that can be +fetched when downloading context definitions or context resources. Since the +process using this factory will be using its own permissions to fetch +resources, and placing a copy of those resources in a local directory where +others may access them, this property allows a system administrator to mitigate +file disclosure security vulnerabilities by preventing it from accessing URLs +that it should not copy locally (e.g. `file:/path/to/accumulo.properties` or +`hdfs://host/path/to/accumulo/rfile.rf`). An example value might look like: +`https://example.com/path/to/contexts/.*`. Review Comment: I wasn't sure where to put this. I put it near the other configuration property I saw. I guess I should have looked more carefully for a better location. I suppose a more complicated regex could be used as an example, but I think a more narrow, more locked down, configuration is going to be more typical, and more secure. I'm sure users can figure out how to write more complicated regexes if they need to. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
