imbajin commented on code in PR #2945:
URL: https://github.com/apache/hugegraph/pull/2945#discussion_r3559210972
##########
hugegraph-store/hg-store-node/src/main/resources/application.yml:
##########
@@ -49,3 +49,10 @@ logging:
config: classpath:log4j2-dev.xml
level:
root: info
+
+arthas:
Review Comment:
Blocking: no. Summary: These node-resource Arthas defaults are not reflected
in the store distribution config, so packaged users will not see or tune the
new settings in `conf/application.yml`. Please add the same `arthas` section to
`hugegraph-store/hg-store-dist/src/assembly/static/conf/application.yml`.
Evidence: the store assembly includes `${assembly.static.dir}/conf`, and
`start-hugegraph-store.sh` loads `${CONF}/application.yml`; the dist
`application.yml` currently ends at the logging section without any `arthas`
keys.
##########
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/arthas/ArthasAPI.java:
##########
@@ -38,6 +40,7 @@
@Path("arthas")
@Singleton
@Tag(name = "ArthasAPI")
+@RolesAllowed("admin")
Review Comment:
Blocking: yes. Summary: This annotation does not protect `PUT /arthas` in
the default no-auth configuration because anonymous requests are treated as
admin. Please add an explicit localhost/no-auth guard here, or require
authentication before calling `ArthasAgent.attach(...)`. Evidence:
`GraphManager.requireAuthentication()` returns false when no authenticator is
configured; `AuthenticationFilter.authenticate()` then returns
`User.ANONYMOUS`; `HugeAuthenticator.User.ANONYMOUS` is constructed with
`ROLE_ADMIN`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
