[Bug] Gremlin sandbox blocks HStore gRPC allocator configuration reads
维护者通常 1 天内回复
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 25/100
调研方向
The report identifies HugeSecurityManager, GremlinGroovyScriptEngine.eval(), and gRPC Utils.getByteBufAllocator; it names no repository test file. Start by reviewing the linked fix in PR #3413 and its regression coverage for worker threads, allocator types, and script-denial checks. Done means the targeted internal property read works while direct script reads and unrelated property access remain denied; the pull request is already open.
由索引模型根据 Issue 内容生成。
描述
Bug Type
Other exception / error: HStore access during Gremlin evaluation.
Environment
- Observed during HStore readiness on Linux/JDK17, with
HugeSecurityManagerenabled andgrpc-netty-shaded1.47.0. The graph had not been populated. - Independently reproduced against current master
f04d5cc8fc2fbd849d6aeef3f111e717a1f8f90d(1.8.0), using its actualgrpc-netty-shaded1.55.3 dependency,GremlinGroovyScriptEngine, and JVM security manager on Temurin 17.0.20.1/macOS aarch64.
Expected and actual behavior
A Gremlin query that reads HStore should be able to initialize an internal gRPC transport while script access to system properties remains restricted.
Instead, the first Gremlin read requiring a new transport fails with HTTP 500 and a gRPC channel panic:
java.lang.SecurityException: Not allowed to access system property(io.grpc.netty.shaded.io.grpc.netty.useCustomAllocator) via Gremlin
at org.apache.hugegraph.security.HugeSecurityManager.newSecurityException(...)
at org.apache.hugegraph.security.HugeSecurityManager.checkPropertyAccess(...)
at java.base/java.lang.System.getProperty(...)
at io.grpc.netty.shaded.io.grpc.netty.Utils.getByteBufAllocator(...)
io.grpc.StatusRuntimeException: INTERNAL: Panic! This is a bug!
Reproduction and cause
- Start a server backed by HStore with the existing security manager enabled.
- Submit a Gremlin read such as
g.V().limit(1).hasNext()that requires a new HStore gRPC transport. No large dataset or application schema is required. - Observe the allocator-property rejection above and the failed query.
Gremlin evaluation -> HStore scan -> new gRPC transport
-> Utils.getByteBufAllocator(boolean)
-> System.getProperty("io.grpc.netty.shaded.io.grpc.netty.useCustomAllocator", "true")
-> HugeSecurityManager rejects the internal read
The allocator reads this property on every invocation, so warming gRPC before Gremlin evaluation does not prevent the failure on later connections.
A focused regression also reproduces the rejection without starting a database or opening a connection: initialize the actual allocator, then invoke it through GremlinGroovyScriptEngine.eval() under HugeSecurityManager on a gremlin-server-exec-* or task-worker-* thread. Both worker paths fail on unmodified master. Calling CompiledScript.eval() directly is insufficient for this reproduction because it omits the engine stack frame used to identify Gremlin.
Proposed fix and verification boundary
Add this exact, non-sensitive boolean configuration flag to the existing property-read whitelist. Direct Gremlin script reads of this one flag are also permitted. Keep sensitive and unrelated property reads and bulk system-property enumeration denied; grant no wildcard access to the gRPC namespace. This avoids coupling production permission checks to a gRPC internal class or method name.
Fix PR: #3413. It includes actual-JAR regression coverage for both worker types and heap/direct allocators, permitted direct flag reads, and the remaining script-denial checks. The exact policy is documented in docs/server-runtime.md. This component reproduction does not establish full distributed HStore integration or benchmark acceptance.
Searched existing issues and PRs for the property and HStore/security-manager failures. Related #3214 concerns denied worker creation during ordered scans; this failure concerns an internal allocator-property read.
- 主要语言
- Java
- 星标
- 3.2k
- 派生
- 642
- 平均合并
- 1 天 7 小时
- 30 天内合并 PR
- 116
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
apache/hugegraph 的其他 Issue
-
[Bug] PD task REST: balanceLeaders throws a bare HTTP 500 during the balance-shard window, and task responses cannot be told apart from a no-op or a follower answer可能已有人在做 @pallavithegod 于 9 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 70/100
apache/hugegraph#3231 · 2 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
[Bug] Store dedup iterators drop rows at query batch boundaries可能已有人在做 @vaidikgarg-bit 于 1 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 84/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 55/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
-
[Bug] PD TTL cleanup deletes the marker-shaped name instead of the expired key, so expired values stay in the store until read可能已有人在做 @bitflicker64 于 8 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
相似的 Issue
-
Component: Frontend Component: Web Component Type: Maintenance
难度 2/5 1-3 小时 新手友好度 76/100
it-at-m/refarch-templates#1944 ·
维护者通常 2 天内回复
-
priority: p2 type: bug
难度 2/5 1-3 小时 新手友好度 68/100
googleapis/java-genai#1372 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 60/100
-
GeoSeries scale and skew tests fail with pytest 9.2.0可能已有人在做 @jiayuasu 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
priority: medium Review effort [1-5]: 3 status: needs-triage type: bug
难度 2/5 1-3 小时 新手友好度 78/100
carlos-emr/carlos#5431 ·
维护者通常 1 天内回复