[SOLR-16164] ConfigSet API returns error if untrusted user creates from _default configset

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 9.0
• Fix Version/s: 9.0
• Component/s: configset-api
• Assignee: Kevin Risden
• Reporter: Eric Pugh
• Created: 24/Apr/22 15:30
• Updated: 12/May/22 00:35
• Resolved: 03/May/22 13:36

Description

Original title: getConfigMetadata() returns NPE if there is no metadata defined on zk node for configset

While attempting to validate SOLR-16110, I discovered that on main, if you attempt to create a configset via the Configset API, you get a NPE.

Utils.fromJSON doesn't handle getting a null, and the call zkClient.getData(CONFIGS_ZKNODE + "/" + configName, null, null, true) is returning a null byte array.

curl "http://localhost:8983/solr/admin/configs?action=CREATE&name=test&baseName=_default"

Issue Links

• is related to: SOLR-16110 Using Schema/Config API breaks the File-Upload of Config Set File
• relates to: SOLR-15258 ConfigSetService: add CRUD operations, subsume ZkConfigManager
• links to: GitHub Pull Request #825