Webinspect scan corrupts lucene indexes

chicks — Wed, 03 Jun 2009 17:20:11 GMT

We're moving Alfresco Labs 3.0Final to QC. Security folks scanned with Webinspect. After backup last night, Alfresco didn't start, complaining about invalid protocol in lucene index tree. Sure enough, there are multiple nonsense directories under lucene-indexes and backup-lucene-indexes, like "ht

Re: Webinspect scan corrupts lucene indexes

chicks — Fri, 05 Jun 2009 15:30:26 GMT

Here's what lucene_indexes winds up looking like after a Webinspect scan:


,`@^*$;<iFrAmE sRc=hTtP                {folderId?}<iFrAmE sRc=hTtP            41076551                               system
,`@^*$;<iMg SrC=hTtP                   {folderId?}<iMg SrC=hTtP               archive                                user
{currentSpace}<iFrAmE sRc=hTtP         {noderef}<iFrAmE sRc=hTtP              avm                                    workspace
{currentSpace}<iMg SrC=hTtP            {noderef}<iMg SrC=hTtP                 baddir123                              www.webinspect.hp.com<iFrAmE sRc=hTtP
{eventId}<iFrAmE sRc=hTtP              {store_type}                           http                                   www.webinspect.hp.com<iMg SrC=hTtP
{eventId}<iMg SrC=hTtP                 {store_type}"><script>alert(097531);<  locks
‍‍‍‍‍‍‍‍

We've discovered that it is ignored in lucene_indexes, but Alfresco refuses to start when this garbage gets copied to backup_lucene_indexes during the 3:00AM job. Our workaround is to run our cold backup at 2:15AM, at which time we delete backup_lucene_indexes (it's only needed if you're doing warm backups). Alfresco will then start right up before backup_lucene_indexes is re-created at 3:00AM.

These garbage directories are obviously being created by the built-in web services. We've deleted all the sample web scripts, hoping for improvement, but unfortunately the built-in web services are causing the problem. Webinspect tries to follow every exposed link, and passes in the variable names along with garbage characters. Somehow these are creating directories in lucene_indexes.

Alfresco, you have a MAJOR issue here, can someone please look into this?

Re: Webinspect scan corrupts lucene indexes

mikeh — Fri, 05 Jun 2009 16:30:16 GMT

Could you please raise this in JIRA? IT will get much more attention there than on the forums.

Thanks,
Mike

topic Re: Webinspect scan corrupts lucene indexes in Alfresco Archive

Webinspect scan corrupts lucene indexes

Re: Webinspect scan corrupts lucene indexes

Re: Webinspect scan corrupts lucene indexes