Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add ingore security check api #1784

Merged
merged 2 commits into from
Mar 21, 2022
Merged

feat: add ingore security check api #1784

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c7c630b
feat: add ingore security check api
zyxxoo Mar 17, 2022
610d83a
feat: improve code
zyxxoo Mar 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions hugegraph-core/src/main/java/com/baidu/hugegraph/security/HugeSecurityManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
import java.security.Permission;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.CopyOnWriteArraySet;

import org.slf4j.Logger;

Expand Down Expand Up @@ -126,6 +127,17 @@ public class HugeSecurityManager extends SecurityManager {
ImmutableSet.of("newSecurityException")
);

private static final Set<String> ignoreCheckedClasses = new CopyOnWriteArraySet<>();

public static void ignoreCheckedClass(String clazz) {
if (callFromGremlin()) {
throw newSecurityException(
"Not allowed to add ignore check via Gremlin");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add ignore-checked class

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this method be called when inited best, if add ignore-checked, maybe it is called on other time;

}

ignoreCheckedClasses.add(clazz);
}

@Override
public void checkPermission(Permission permission) {
if (DENIED_PERMISSIONS.contains(permission.getName()) &&
Expand Down Expand Up @@ -167,7 +179,7 @@ public void checkAccess(Thread thread) {
if (callFromGremlin() && !callFromCaffeine() &&
!callFromAsyncTasks() && !callFromEventHubNotify() &&
!callFromBackendThread() && !callFromBackendHbase() &&
!callFromRaft() && !callFromSofaRpc()) {
!callFromRaft() && !callFromSofaRpc() && !callFromIgnoreCheckedClass()) {
throw newSecurityException(
"Not allowed to access thread via Gremlin");
}
Expand All @@ -179,7 +191,8 @@ public void checkAccess(ThreadGroup threadGroup) {
if (callFromGremlin() && !callFromCaffeine() &&
!callFromAsyncTasks() && !callFromEventHubNotify() &&
!callFromBackendThread() && !callFromBackendHbase() &&
!callFromRaft() && !callFromSofaRpc()) {
!callFromRaft() && !callFromSofaRpc() &&
!callFromIgnoreCheckedClass()) {
throw newSecurityException(
"Not allowed to access thread group via Gremlin");
}
Expand Down Expand Up @@ -475,6 +488,10 @@ private static boolean callFromNewSecurityException() {
return callFromMethods(NEW_SECURITY_EXCEPTION);
}

private static boolean callFromIgnoreCheckedClass() {
return callFromWorkerWithClass(ignoreCheckedClasses);
}

private static boolean callFromWorkerWithClass(Set<String> classes) {
Thread curThread = Thread.currentThread();
if (curThread.getName().startsWith(GREMLIN_SERVER_WORKER) ||
Expand Down