lucene-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Robert Muir (Jira)" <>
Subject [jira] [Created] (SOLR-13983) remove or replace process execution in SystemInfoHandler
Date Fri, 29 Nov 2019 20:46:00 GMT
Robert Muir created SOLR-13983:

             Summary: remove or replace process execution in SystemInfoHandler
                 Key: SOLR-13983
             Project: Solr
          Issue Type: Improvement
      Security Level: Public (Default Security Level. Issues are Public)
            Reporter: Robert Muir

SystemInfoHandler is the only place in solr code executing processes. 

Since solr is a server/long running process listening to HTTP, ideally process execution could
be disabled (e.g. with security manager). But first this code needs to be removed or replaced,
so that there is no legitimate use of it:

try { 
      if (!Constants.WINDOWS) {
        info.add( "uname",  execute( "uname -a" ) );
        info.add( "uptime", execute( "uptime" ) );
    } catch( Exception ex ) {
      log.warn("Unable to execute command line tools to get operating system properties.",
    return info;

It already looks like its getting data from OS MXbean here, so maybe this logic is simply
outdated or not needed. It seems to be "best-effort" anyway. Alternatively similar stuff could
be fetched by reading from e.g. /proc file system location if needed.

This message was sent by Atlassian Jira

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message