jackrabbit-oak-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Thomas Mueller (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OAK-8167) With uneven distribution of ACL restriction across facet labels statistical facet count become too inaccurate
Date Tue, 23 Apr 2019 12:35:00 GMT

    [ https://issues.apache.org/jira/browse/OAK-8167?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16824078#comment-16824078
] 

Thomas Mueller commented on OAK-8167:
-------------------------------------

In my view, there are two items: 
* the security aspect of the current implementation (which [~anchela] talked about), and 
* [~kexu] notes that statistical facet count can be inaccurate (but does not provide a possible
solution for it).

The security aspect, I think we need to properly document it, and ensure it's secure by default.
As far as I read the relevant documentation at http://jackrabbit.apache.org/oak/docs/query/lucene.html#facets
, it is secure by default. However, I think we fail to document that "statistical" is _also_
leaking some data. I will document this.

However, [~kexu] I don't see how we could improve the situation. Do you have any possible
solution in mind? If not, I'm afraid we have to close the issue as won't fix.

> With uneven distribution of ACL restriction across facet labels statistical facet count
become too inaccurate
> -------------------------------------------------------------------------------------------------------------
>
>                 Key: OAK-8167
>                 URL: https://issues.apache.org/jira/browse/OAK-8167
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: lucene, query
>    Affects Versions: 1.6.16
>            Reporter: Kelvin Xu
>            Priority: Major
>              Labels: vulnerability
>
> With the statistical mode, facet count is updated proportionally to the percentage of
accessible samples, which works for secured contents scattered across different facets. For
edge case where the whole facet (results) is not accessible, the count still shows a number
after the sampling percent is applied. Even if the number is small, user experience is misleading/inaccurate
as nothing would return when the facet is clicked (applied as a query condition).
> For example, a ACLs/CUGs guarded "private" folder, in which all the assets are tagged
with the same facet value. Non authorized user may still see this facet with a count but gets
nothing when clicking on the facet.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message