cassandra-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "T Jake Luciani (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CASSANDRA-9890) Bytecode inspection for Java-UDFs
Date Fri, 31 Jul 2015 18:00:06 GMT

    [ https://issues.apache.org/jira/browse/CASSANDRA-9890?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14649559#comment-14649559
] 

T Jake Luciani commented on CASSANDRA-9890:
-------------------------------------------

+1 very nice!

> Bytecode inspection for Java-UDFs
> ---------------------------------
>
>                 Key: CASSANDRA-9890
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-9890
>             Project: Cassandra
>          Issue Type: Improvement
>            Reporter: Robert Stupp
>            Assignee: Robert Stupp
>             Fix For: 3.0.0 rc1
>
>
> (Follow-up to CASSANDRA-9402)
> For Java-UDFs we could inspect the compiled Java byte code to find usages of the Java
language that are "forbidden" to UDFs.
> These include usages of:
> * {{synchronized}} keyword
> * call to {{j.l.Object.wait}}
> * call to {{j.l.Object.notify}}
> * call to {{j.l.Object.notifyAll}}
> * call to {{j.l.Object.getClass}}
> * calls to specific methods of currently allowed classes in the driver (but would need
some investigation)
> By inspecting the byte code _before_ the class is actually used, even dirty constructs
like the following would be impossible:
> {noformat}
> CREATE OR REPLACE FUNCTION ... AS $$  return Math.sin(val);
> }
> {
>   // anonymous initializer code
> }
> static {
>   // static initializer code
> $$;
> {noformat}
> (inspired by [this blog post|http://jordan-wright.com/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/])



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message