[ARTEMIS-3017] ArtemisJMXSecurity bulk canInvoke operation always returns true

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.16.0
• Fix Version/s: 2.17.0
• Component/s: JMX, Web Console
• Assignee: Unassigned
• Reporter: Tadayoshi Sato
• Created: 03/Dec/20 10:26
• Updated: 09/Feb/21 21:24
• Resolved: 09/Dec/20 16:50

Description

Let's send this bulk request to http://localhost:8161/console/jolokia/, eg:

curl -u admin:admin -d @data.json -H "Content-Type: application/json" http://localhost:8161/console/jolokia/ | jq

data.json

[
  {
    "type": "exec",
    "mbean": "hawtio:type=security,area=jmx,name=ArtemisJMXSecurity",
    "operation": "canInvoke(java.lang.String,java.lang.String)",
    "arguments": [
      "java.lang:type=Memory",
      "gc()"
    ]
  },
  {
    "type": "exec",
    "mbean": "hawtio:type=security,area=jmx,name=ArtemisJMXSecurity",
    "operation": "canInvoke(java.util.Map)",
    "arguments": [
      {
        "java.lang:type=Memory": [
          "gc()"
        ]
      }
    ]
  }
]

Even if the first result gets false, the seconde one always returns true.

It is because HawtioSecurityControlImpl#canInvoke(java.util.Map) isn't yet really implemented.

Issue Links

• links to: GitHub Pull Request #3367