Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Correct permissions of jackson-databind "the correct way" #5767

Closed
wants to merge 1 commit into from
Closed

Correct permissions of jackson-databind "the correct way" #5767

wants to merge 1 commit into from

Conversation

uschindler
Copy link
Contributor

Description

[Describe what this change achieves]

Issues Resolved

This is to demonstrate how to fix #5504 the "correct way"

Check List

  • New functionality includes testing.
    • All tests pass
  • New functionality has been documented.
    • New functionality has javadoc added
  • Commits are signed per the DCO using --signoff
  • Commit changes are listed out in CHANGELOG.md file (See: Changelog)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@uschindler uschindler marked this pull request as draft January 9, 2023 18:17
@uschindler uschindler mentioned this pull request Jan 9, 2023
Open
uschindler
uschindler commented Jan 9, 2023
View reviewed changes
server/src/test/java/org/opensearch/common/settings/WriteableSettingTests.java
@@ -462,6 +463,7 @@ public void testVersionSetting() throws IOException {
}
}

@Ignore("https://github.com/opensearch-project/OpenSearch/issues/5504")
Copy link
Contributor Author

@uschindler uschindler Jan 9, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test of course fails as it uses setAccessible and also adds SuppressForbidden!? There was a reason why the forbiddenapis forbids setAccessible()!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you're saying that this is by design. Let's rewrite the test as such!

Copy link
Contributor Author

@uschindler uschindler Jan 10, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See other PR #5768, I made a proposal. Alternatively remove the test. Because if the fields are "final" theres no need to test any other value than the final value.

reta
reta reviewed Jan 9, 2023
View reviewed changes
server/src/main/resources/org/opensearch/bootstrap/security.policy
@@ -79,6 +79,12 @@ grant codeBase "${codebase.jna}" {
permission java.lang.RuntimePermission "accessDeclaredMembers";
};

grant codeBase "${codebase.jackson-databind}" {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately this is not working for jackson-databind, so we need a workaround or we should look at the new PR #5768.

@github-actions
Copy link
Contributor

github-actions bot commented Jan 9, 2023

Gradle Check (Jenkins) Run Completed with:

@uschindler
Copy link
Contributor Author

I will close this as we have #5768, removing the dependency from server core.

In general this approach is the correct one to limit permissions to specific JAR files, but the downside is that the JAR file must implement AccessController#doPrivileged() whenever calling secrurity-critical APIs.

@uschindler uschindler closed this Jan 10, 2023
@uschindler uschindler deleted the draft/fix-permissions-jackson branch January 10, 2023 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@reta reta reta left review comments

@anasalkouz anasalkouz Awaiting requested review from anasalkouz anasalkouz is a code owner

@andrross andrross Awaiting requested review from andrross andrross is a code owner

@Bukhtawar Bukhtawar Awaiting requested review from Bukhtawar Bukhtawar is a code owner

@CEHENKLE CEHENKLE Awaiting requested review from CEHENKLE CEHENKLE is a code owner

@dblock dblock Awaiting requested review from dblock dblock is a code owner

@gbbafna gbbafna Awaiting requested review from gbbafna gbbafna is a code owner

@setiah setiah Awaiting requested review from setiah

@kartg kartg Awaiting requested review from kartg

@kotwanikunal kotwanikunal Awaiting requested review from kotwanikunal kotwanikunal is a code owner

@mch2 mch2 Awaiting requested review from mch2 mch2 is a code owner

@nknize nknize Awaiting requested review from nknize nknize is a code owner

@owaiskazi19 owaiskazi19 Awaiting requested review from owaiskazi19 owaiskazi19 is a code owner

@adnapibar adnapibar Awaiting requested review from adnapibar

@Rishikesh1159 Rishikesh1159 Awaiting requested review from Rishikesh1159 Rishikesh1159 is a code owner

@ryanbogan ryanbogan Awaiting requested review from ryanbogan

@saratvemulapalli saratvemulapalli Awaiting requested review from saratvemulapalli saratvemulapalli is a code owner

@shwetathareja shwetathareja Awaiting requested review from shwetathareja shwetathareja is a code owner

@dreamer-89 dreamer-89 Awaiting requested review from dreamer-89

@tlfeng tlfeng Awaiting requested review from tlfeng

@VachaShah VachaShah Awaiting requested review from VachaShah VachaShah is a code owner

@xuezhou25 xuezhou25 Awaiting requested review from xuezhou25

@ashking94 ashking94 Awaiting requested review from ashking94 ashking94 will be requested when the pull request is marked ready for review ashking94 is a code owner

@dbwiddis dbwiddis Awaiting requested review from dbwiddis dbwiddis will be requested when the pull request is marked ready for review dbwiddis is a code owner

@jainankitk jainankitk Awaiting requested review from jainankitk jainankitk will be requested when the pull request is marked ready for review jainankitk is a code owner

@linuxpi linuxpi Awaiting requested review from linuxpi linuxpi will be requested when the pull request is marked ready for review linuxpi is a code owner

@msfroh msfroh Awaiting requested review from msfroh msfroh will be requested when the pull request is marked ready for review msfroh is a code owner

@sachinpkale sachinpkale Awaiting requested review from sachinpkale sachinpkale will be requested when the pull request is marked ready for review sachinpkale is a code owner

@sohami sohami Awaiting requested review from sohami sohami will be requested when the pull request is marked ready for review sohami is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Evaluate the permission change for jackson-databind
3 participants
@uschindler @reta @dblock