Details
-
Improvement
-
Status: Closed
-
Blocker
-
Resolution: Fixed
-
None
-
None
Description
<lib> directives in solrconfig.xml used to be recommended way for including additional jar files to the classpath for a particular collection or collections.
For context: This feature required complex handling of "trusted" vs "non-trusted" configsets in configset upload API to keep Solr secure (i.e. to stop RCE attacks for non-authentication enabled deployments). This security feature also broke down recently due to a bug in Schema designer (SOLR-16777).
Supported alternatives exist that are safer:
- user can add the jar files to Solr's classpath
- use packages to use custom jars per collection
In the light of these, there's no need to continue to support the <lib> directive going forward.
I propose to remove the <lib> directives handling and functionality through this issue.
Attachments
Attachments
Issue Links
- duplicates
-
SOLR-6681 remove <lib> configurations from solrconfig.xml and eliminate per core class loading
-
- Open
-
- links to