From 6f360b6d239a7b3d3b625e1bcefcaeb2f6b2be1d Mon Sep 17 00:00:00 2001
From: Robert Stupp <snazy@snazy.de>
Date: Thu, 5 Jan 2017 22:18:37 +0100
Subject: [PATCH] Remove support for non-JavaScript UDFs

patch by Robert Stupp; reviewed by Tyler Hobbs for CASSANDRA-12883
---
 CHANGES.txt                                      |  1 +
 NEWS.txt                                         | 16 ++++++++++++++++
 .../cassandra/cql3/functions/ScriptBasedUDF.java |  5 +++++
 3 files changed, 22 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index d31ffc8d67..b41313dba6 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 2.2.9
+ * Remove support for non-JavaScript UDFs (CASSANDRA-12883)
  * Fix DynamicEndpointSnitch noop in multi-datacenter situations (CASSANDRA-13074)
  * cqlsh copy-from: encode column names to avoid primary key parsing errors (CASSANDRA-12909)
  * Temporarily fix bug that creates commit log when running offline tools (CASSANDRA-8616)
diff --git a/NEWS.txt b/NEWS.txt
index 0a3ab36784..37949a162f 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -13,6 +13,19 @@ restore snapshots created with the previous major version using the
 'sstableloader' tool. You can upgrade the file format of your snapshots
 using the provided 'sstableupgrade' tool.
 
+2.2.9
+=====
+
+Deprecation
+-----------
+
+(See note about the new feature User-Defined-Functions in 2.2.0.)
+
+Since the security manager added in 3.0 only allows Java and JavaScript
+UDFs to be run, UDFs for other languages are deprecated and support for
+non-Java and non-JavaScript UDFs is deprecated in 2.2 and has been removed
+in version 3.0.11.
+
 2.2.8
 =====
 
@@ -230,6 +243,9 @@ New features
      3.0.  This will inherently be backwards-incompatible with any 2.2
      UDF that perform insecure operations such as opening a socket or
      writing to the filesystem.
+
+     Per the previous note about adding a security manager in 3.0, this security manager
+     means that non JavaScipt UDF's won't run, there for their use is deprecated.
      ************************************************************************
    - Row-cache is now fully off-heap.
    - jemalloc is now automatically preloaded and used on Linux and OS-X if
diff --git a/src/java/org/apache/cassandra/cql3/functions/ScriptBasedUDF.java b/src/java/org/apache/cassandra/cql3/functions/ScriptBasedUDF.java
index e55d450883..2d46934277 100644
--- a/src/java/org/apache/cassandra/cql3/functions/ScriptBasedUDF.java
+++ b/src/java/org/apache/cassandra/cql3/functions/ScriptBasedUDF.java
@@ -73,6 +73,11 @@ public class ScriptBasedUDF extends UDFunction
     {
         super(name, argNames, argTypes, returnType, calledOnNullInput, language, body);
 
+        if (!"JavaScript".equalsIgnoreCase(language))
+            logger.warn("Support for UDFs using '" + language + "' has been deprecated and removed in 3.0. If '" +
+                        language + "' actually is JavaScript, change the language used in CREATE/ALTER FUNCTION to " +
+                        "'javascript'.");
+
         Compilable scriptEngine = scriptEngines.get(language);
         if (scriptEngine == null)
             throw new InvalidRequestException(String.format("Invalid language '%s' for function '%s'", language, name));