Uploaded image for project: 'Sling'
  1. Sling
  2. SLING-4748

Request using "sling:bg=true" causes StackOverflow when no read access to /var

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: Background Servlets 1.0.0
    • Fix Version/s: Background Servlets 1.0.0
    • Component/s: Extensions
    • Labels:
      None

      Description

      I have a system, where the anonymous user does not have read access to /var/bg. When I do a call to it (for example: http://localhost:4503/?sling:bg=true", it returns with a internal server error. The log shows a stackoverflow exception, caused by

      ...
      at org.apache.sling.bgservlets.impl.DeepNodeCreator.deepCreateNode(DeepNodeCreator.java:54)
      at org.apache.sling.bgservlets.impl.DeepNodeCreator.deepCreateNode(DeepNodeCreator.java:54)
      ...
      

      Looking at this line in the code I see a recursive call of deepCreateNode, which is executed, when the item itself does not exist. Which is true from the view of an anonymous session, which doesn't have read access to nodes beneath /var.

      The code should be improved, so it does either check with an admin session that the path exists, but is simply not readable, or preferably add some detection, that it has already reached "/" and that it doesn't make sense to continue then.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                bdelacretaz Bertrand Delacretaz
                Reporter:
                joerghoh Joerg Hoh
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: