Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-13987

Admin UI should not rely on javascript eval()

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 8.4
    • Admin UI
    • None

    Description

      Followup from SOLR-13982: currently any CSP is weak because it must allow this eval: means arbitrary javascript can still be executed.

      Let's fix the admin UI to not require eval so it can be disabled by the browser.

      Attachments

        Issue Links

        is related to

        Bug - A problem which impairs or prevents the functions of the product. SOLR-14039 SOLR-13987 broke multiple node /select handler due to jetty.xml whitespace

        • Major - Major loss of function.
        • Closed
        relates to

        Bug - A problem which impairs or prevents the functions of the product. SOLR-14176 Graph of SolrCloud is not shown in UI

        • Major - Major loss of function.
        • Resolved

        Improvement - An improvement or enhancement to an existing feature or task. SOLR-13982 set security-related http response headers by default

        • Major - Major loss of function.
        • Closed

        Improvement - An improvement or enhancement to an existing feature or task. SOLR-14014 Allow Solr to start with Admin UI disabled

        • Major - Major loss of function.
        • Closed
        links to

        Web Link GitHub Pull Request #1066

        Activity
          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            krisden Kevin Risden
            rcmuir Robert Muir
            Votes:
            0 Vote for this issue
            Watchers:
            10 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 40m
                40m

                Slack

                  Issue deployment