fix(security): default the dynamic-code kill-switch to off in every run mode#2863
Closed
hongwei1 wants to merge 1 commit into
Closed
fix(security): default the dynamic-code kill-switch to off in every run mode#2863hongwei1 wants to merge 1 commit into
hongwei1 wants to merge 1 commit into
Conversation
…un mode allow_user_generated_scala_code previously defaulted to true in test/dev run modes when unset, only defaulting to false in production. Per review feedback, remove the run-mode fallback entirely: the prop must now be set explicitly to true anywhere, including test and dev, or dynamic Scala/JS/Java compilation stays disabled. Set the prop explicitly in the CI "Setup props" steps and in test.default.props.template / run_tests_parallel.sh so the existing dynamic-code test suites keep exercising the ON path locally and in CI. Update DynamicCodeKillSwitchTest's predicate scenarios to reflect that the suite's baseline is now an explicit prop value, not an implicit test-mode default.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #2860 per review feedback from @simonredfern.
allow_user_generated_scala_codepreviously defaulted totruein test/dev run modes when unset, andfalseonly in production. This PR removes that run-mode fallback: the prop must now be explicitly set totrueanywhere — including test and dev — or dynamic Scala/JS/Java compilation stays disabled. There is no implicit "on" state left inDynamicUtil.dynamicCodeExecutionEnabledat all.build_pull_request.yml,build_container.yml) and intest.default.props.template/run_tests_parallel.sh, so the existing dynamic-code test suites (DynamicUtilTest,ConnectorMethodTest,AbacRuleTests,DynamicResourceDocTest,DynamicMessageDocTest,DynamicCodeKillSwitchTest) keep exercising their ON scenarios locally and in CI.DynamicCodeKillSwitchTest's predicate scenarios to reflect that the suite's "enabled" baseline is now an explicit prop value rather than an implicit test-mode default (there's no way to exercise the truly-absent case from within the test harness, since the base props file always supplies a value once it's set — that branch is covered by direct inspection of the match expression).Test plan
mvn install -pl .,obp-commons -am -DskipTests— BUILD SUCCESSmvn test-compile -pl obp-api -am— main + test sources compile cleanDynamicCodeKillSwitchTest,DynamicUtilTest,ConnectorMethodTest,AbacRuleTests,DynamicResourceDocTest,DynamicMessageDocTest,ResourceDocsTest) — 114 succeeded, 0 failed (3 canceled are pre-existing JDK24+SecurityManager-unavailable skips, unrelated to this change)