paulk-asert opened a new pull request, #2870: URL: https://github.com/apache/groovy/pull/2870
connectorServer takes a host, defaulting to localhost, but it reached only the service URL. The authority before /jndi/ was left empty, which exports the RMI object on every interface, so host named the registry the stub was bound into and never restricted the listener. A connector asked for localhost was reachable from any host that could route to the port, and since the default MBean server is the platform one, that offered HotSpotDiagnostic.dumpHeap and the DiagnosticCommand operations to whoever arrived. The connector now binds the host it was given. Both halves are needed: the server socket factory decides where the exported object listens, and the stub carries the client factory, which decides where a client dials. Binding without the second leaves clients dialling the host RMI advertises, where nothing is listening. A caller who supplied either factory keeps their own, so the SSL path is untouched, and a wildcard host still listens everywhere. Starting a connector that both reaches other hosts and authenticates nobody now warns. A connector confined to loopback stays quiet, so the warning marks the case where a peer other than the operator can arrive. The documentation recorded that its own example failed on Mac and CentOS 5 under Groovy 1.6 and wondered about /etc/hosts. The example fails because it does not create the RMI registry, which the corrected example below it already showed, so it now says that and describes what the connector exposes and to whom. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
