[
https://issues.apache.org/jira/browse/TIKA-4974?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18128089#comment-18128089
]
ASF GitHub Bot commented on TIKA-4974:
--------------------------------------
Copilot commented on code in PR #3352:
URL: https://github.com/apache/tika/pull/3352#discussion_r4301776803
##########
tika-serialization/src/main/java/org/apache/tika/config/loader/ComponentInstantiator.java:
##########
@@ -225,6 +238,43 @@ public static <T> T instantiateComponent(String typeName,
JsonNode configNode,
}
}
+ /**
+ * Refuses what per-request JSON may not build: a class of a
request-blocked type, a class
+ * marked {@link OperatorOnly}, or config naming an {@code @OperatorOnly}
property. Runs
+ * before construction, since constructing a component can have side
effects.
+ */
+ public static void assertRequestMayConfigure(String typeName, Class<?>
clazz,
+ JsonNode config, ObjectMapper
mapper)
+ throws TikaConfigException {
+ if (ComponentNameResolver.isWireBlockedClass(clazz)) {
+ throw new TikaConfigException("Component '" + typeName + "' (" +
clazz.getName()
+ + ") may not be supplied via a request parseContext. It
must be configured "
+ + "server-side in the Tika config, not at request time.");
+ }
+ try {
+ OperatorOnlyGuard.check(mapper, typeName, config,
mapper.constructType(clazz));
+ } catch (IOException e) {
+ throw new TikaConfigException(e.getMessage(), e);
+ }
+ }
+
+ /**
+ * Carries the request's trust into the components a config nests: Jackson
builds them
+ * through {@code TikaModule}, which reads {@link #UNTRUSTED} back.
+ */
+ public static ObjectReader withTrust(ObjectReader reader, boolean trusted)
{
+ return trusted ? reader : reader.withAttribute(UNTRUSTED,
Boolean.TRUE);
+ }
+
+ /** True if {@code ctxt} is reading per-request JSON (see {@link
#withTrust}). */
Review Comment:
This Javadoc reverses the return value: per-request JSON carries the
`UNTRUSTED` attribute, so `isTrusted()` returns false. Document the trusted
case to avoid misleading callers of this security-sensitive predicate.
> Use @OperatorOnly to block classes rather than rely on
> WIRE_BLOCKED_COMPONENT_NAMES
> -----------------------------------------------------------------------------------
>
> Key: TIKA-4974
> URL: https://issues.apache.org/jira/browse/TIKA-4974
> Project: Tika
> Issue Type: Task
> Reporter: Tim Allison
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
