Mailing-List: contact dev-help@lucene.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@lucene.apache.org
Date: Sat, 2 Jul 2011 18:36:21 +0000 (UTC)
From: "Hoss Man (JIRA)" <jira@apache.org>
To: dev@lucene.apache.org
Message-ID: <740338911.132.1309631781857.JavaMail.tomcat@hel.zones.apache.org>
In-Reply-To: 
 <1154454947.9691.1309552889011.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] [Reopened] (SOLR-2631) PingRequestHandler can infinite loop
 if called with a qt that points to itsself
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/SOLR-2631?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Hoss Man reopened SOLR-2631:
----------------------------


we shouldn't consider tis resolved until we also apply the "work around" provided by Edoardo to the example and test solrconfig.xml files as well.

that way people who copy them in the future won't get any error at all.

> PingRequestHandler can infinite loop if called with a qt that points to itsself
> -------------------------------------------------------------------------------
>
>                 Key: SOLR-2631
>                 URL: https://issues.apache.org/jira/browse/SOLR-2631
>             Project: Solr
>          Issue Type: Bug
>          Components: search, web gui
>    Affects Versions: 1.4, 3.1, 3.2, 3.3
>            Reporter: Uwe Schindler
>            Assignee: Uwe Schindler
>              Labels: security
>             Fix For: 3.4, 4.0
>
>         Attachments: SOLR-2631.patch
>
>
> We got a security report to private@lucene.apache.org, that Solr can infinite loop, use 100% CPU and stack overflow, if you execute the following HTTP request: 
> - http://localhost:8983/solr/select?qt=/admin/ping
> - http://localhost:8983/solr/admin/ping?qt=/admin/ping
> The qt paramter instructs PingRequestHandler to call the given request handler. This leads to an infinite loop. This is not an security issue, but for an unprotected Solr server with unprotected /solr/select path this makes it stop working.
> The fix is to prevent infinite loop by disallowing calling itsself.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

        
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org