Apache
/
lucene
mirror of https://github.com/apache/lucene.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

LUCENE-10101: Use getField() instead of getDeclaredField() to minimize security impact by analysis SPI discovery (#298)

This commit is contained in:
Uwe Schindler 2021-09-14 10:31:46 +02:00 committed by GitHub
parent 19537578dd
commit 3802bdc686
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lucene/CHANGES.txt
View File

@ -310,6 +310,9 @@ Bug fixes
* LUCENE-10047: Fix a value de-duping bug in LongValueFacetCounts and RangeFacetCounts
(Greg Miller)
* LUCENE-10101, LUCENE-9281: Use getField() instead of getDeclaredField() to
minimize security impact by analysis SPI discovery. (Uwe Schindler)
Changes in Backwards Compatibility Policy

6
lucene/core/src/java/org/apache/lucene/analysis/AnalysisSPILoader.java
View File

@ -174,11 +174,11 @@ public final class AnalysisSPILoader<S extends AbstractAnalysisFactory> {
*/
public static String lookupSPIName(Class<? extends AbstractAnalysisFactory> service)
throws NoSuchFieldException, IllegalAccessException, IllegalStateException {
final Field field = service.getDeclaredField("NAME");
final Field field = service.getField("NAME");
int modifier = field.getModifiers();
if (Modifier.isPublic(modifier)
&& Modifier.isStatic(modifier)
if (Modifier.isStatic(modifier)
&& Modifier.isFinal(modifier)
&& Objects.equals(field.getDeclaringClass(), service)
&& Objects.equals(field.getType(), String.class)) {
return ((String) field.get(null));
}