SOLR-8262: Comment out /stream handler from sample solrconfig.xml's for security reasons

git-svn-id: https://svn.apache.org/repos/asf/lucene/dev/trunk@1713530 13f79535-47bb-0310-9956-ffa450edef68

solr/CHANGES.txt

@@ -354,6 +354,9 @@ Bug Fixes
 * SOLR-8254: HttpSolrCore.getCoreByCollection() can throw NPE (Alan Woodward,
   Mark Miller)
 
+* SOLR-8262: Comment out /stream handler from sample solrconfig.xml's for security reasons
+  (Joel Bernstein)
+
 Optimizations
 ----------------------
 

solr/server/solr/configsets/data_driven_schema_configs/conf/solrconfig.xml

@@ -870,9 +870,19 @@
   </requestHandler>
 
 
-    <!--
+  <!--
-    Distributed Stream processing.
+
-    -->
+    Uncomment for distributed Stream processing (also required by the /sql handler in map_reduce mode).
+
+    SECURTIY WARNING: This feature uses Java Serialization for RPC (Remote Procedure Calls) to send executable
+                      Java Objects to Worker nodes.
+
+                      Solr also currently has apache commons-collections in it's classpath.
+
+                      This makes Solr vulnerable to this security exploit:
+
+                      https://issues.apache.org/jira/browse/COLLECTIONS-580.
+
 
   <requestHandler name="/stream" class="solr.StreamHandler">
     <lst name="invariants">
@@ -881,6 +891,7 @@
     </lst>
   </requestHandler>
 
+  -->
 
   <requestHandler name="/sql" class="solr.SQLHandler">
     <lst name="invariants">

solr/server/solr/configsets/sample_techproducts_configs/conf/solrconfig.xml

@@ -899,15 +899,27 @@
 
 
   <!--
-  Distributed Stream processing.
-  -->
 
-  <requestHandler name="/stream" class="solr.StreamHandler">
+   Uncomment for distributed Stream processing (also required by the /sql handler in map_reduce mode).
-    <lst name="invariants">
+
-      <str name="wt">json</str>
+   SECURTIY WARNING: This feature uses Java Serialization for RPC (Remote Procedure Calls) to send executable
-      <str name="distrib">false</str>
+                     Java Objects to Worker nodes.
-    </lst>
+
-  </requestHandler>
+                     Solr also currently has apache commons-collections in it's classpath.
+
+                     This makes Solr vulnerable to this security exploit:
+
+                     https://issues.apache.org/jira/browse/COLLECTIONS-580.
+
+
+ <requestHandler name="/stream" class="solr.StreamHandler">
+   <lst name="invariants">
+     <str name="wt">json</str>
+     <str name="distrib">false</str>
+   </lst>
+ </requestHandler>
+
+ -->
 
 
   <requestHandler name="/sql" class="solr.SQLHandler">