Repository navigation
TIKA-4974: enforce @OperatorOnly wherever a request builds a component - #3352
Merged
Merged
Conversation
Contributor
Author
|
This is based on the point made here: #3351 We should make this easier not to get wrong. |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Cross-module trust enforcement and configuration compatibility changes warrant human review and integration-test validation.
1 open issue
What changed in this PR
Extends Tika’s @OperatorOnly enforcement across request-driven component construction while preserving explicit trust for operator configuration.
Changes:
- Propagates trust through component loading and nested deserialization.
- Adds inherited class-level restrictions and explicit trusted JSON configuration.
- Adds regression tests and documents configuration compatibility changes.
| File | Description |
|---|---|
| tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/TikaResource.java | Preserves trust when merging configuration. |
| tika-serialization/src/test/java/org/apache/tika/serialization/WireRestrictedParseContextTest.java | Updates tests for construction-time enforcement. |
| tika-serialization/src/test/java/org/apache/tika/serialization/OperatorOnlyComponentTest.java | Tests trusted and restricted construction paths. |
| tika-serialization/src/test/java/org/apache/tika/metadata/filter/OperatorOnlySetterTestFilter.java | Adds restricted-setter fixture. |
| tika-serialization/src/test/java/org/apache/tika/metadata/filter/OperatorOnlyJsonConfigTestFilter.java | Adds JSON-constructor fixture. |
| tika-serialization/src/test/java/org/apache/tika/metadata/filter/OperatorOnlyClassTestFilter.java | Adds restricted-class fixture. |
| tika-serialization/src/test/java/org/apache/tika/metadata/filter/NestingTestFilter.java | Adds nested-component fixture. |
| tika-serialization/src/main/java/org/apache/tika/serialization/TikaModule.java | Passes trust into nested construction. |
| tika-serialization/src/main/java/org/apache/tika/serialization/serdes/ParseContextDeserializer.java | Replaces name blocking with class checks. |
| tika-serialization/src/main/java/org/apache/tika/serialization/ParseContextUtils.java | Enforces trust during context resolution. |
| tika-serialization/src/main/java/org/apache/tika/serialization/OperatorOnlyGuard.java | Exposes the typed guard publicly. |
| tika-serialization/src/main/java/org/apache/tika/serialization/ComponentNameResolver.java | Adds class-based request restrictions. |
| tika-serialization/src/main/java/org/apache/tika/config/loader/TikaObjectMapperFactory.java | Adds guarded configuration reading. |
| tika-serialization/src/main/java/org/apache/tika/config/loader/InferenceLoader.java | Marks operator-loaded components trusted. |
| tika-serialization/src/main/java/org/apache/tika/config/loader/FrameworkConfig.java | Marks extracted operator JSON trusted. |
| tika-serialization/src/main/java/org/apache/tika/config/loader/EngineLoader.java | Marks operator-loaded engines trusted. |
| tika-serialization/src/main/java/org/apache/tika/config/loader/ComponentInstantiator.java | Enforces restrictions and propagates trust. |
| tika-parsers/tika-parsers-ml/tika-inference/src/main/java/org/apache/tika/inference/AbstractEmbeddingFilter.java | Blocks request construction through annotation. |
| tika-core/src/main/java/org/apache/tika/config/OperatorOnly.java | Supports inherited class-level restrictions. |
| tika-core/src/main/java/org/apache/tika/config/JsonConfig.java | Adds explicit trusted configuration factory. |
| tika-core/src/main/java/org/apache/tika/config/ConfigDeserializer.java | Requires guarded serialization support. |
| docs/modules/ROOT/pages/developers/serialization.adoc | Documents enforcement and trust requirements. |
| CHANGES.txt | Records enforcement and compatibility changes. |
Review effort: Balanced
# Conflicts: # CHANGES.txt
…nstructors work in OSGi Generated-by: Claude Opus 5.5
Generated-by: Claude Opus 5.5
…t regardless of resolve order Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…service, not reflection Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Thanks for your contribution to Apache Tika! Your help is appreciated!
Before opening the pull request, please verify that
TIKA-XXXX)[TIKA-XXXX] Issue or pull request title)./mvnw clean install(clean testalone cannot resolve the pipes plugin zips)Generated-by: <tool>in the commit message), and consider running the pre-flight in.skills/devs/pr-review/SKILL.md— fix what it finds; don't paste its report heremainbranch. If there are conflicts, please try to rebase the pull request branch on top of a freshly pulledmainbranchtika-bom/pom.xml.We will be able to faster integrate your pull request if these conditions are met. If you have any questions how to fix your problem or about using Tika in general, please sign up for the Tika mailing list. Thanks!