From 63f4da90c3c51d230c535265786dbc7a33c1ace9 Mon Sep 17 00:00:00 2001 From: Brandon Williams Date: Thu, 27 Aug 2020 13:20:31 -0500 Subject: [PATCH] Only allow strings to be passed to JMX authentication patch by Brandon Williams; reviewed by Mick Semb Wever for CASSANDRA-16077 --- CHANGES.txt | 1 + src/java/org/apache/cassandra/service/CassandraDaemon.java | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGES.txt b/CHANGES.txt index 367504ba17..04cbfa3fa2 100644 --- a/CHANGES.txt +++ b/CHANGES.txt @@ -1,4 +1,5 @@ 2.1.22 + * Only allow strings to be passed to JMX authentication (CASSANDRA-16077) * Disable JMX rebinding (CASSANDRA-15653, CASSANDRA-16075) 2.1.21 diff --git a/src/java/org/apache/cassandra/service/CassandraDaemon.java b/src/java/org/apache/cassandra/service/CassandraDaemon.java index afd376e800..313cc9db2e 100644 --- a/src/java/org/apache/cassandra/service/CassandraDaemon.java +++ b/src/java/org/apache/cassandra/service/CassandraDaemon.java @@ -104,8 +104,10 @@ public class CassandraDaemon try { RMIServerSocketFactory serverFactory = new RMIServerSocketFactoryImpl(); - Map env = Collections.singletonMap(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE, serverFactory); - + Map env = new HashMap<>(); + env.put(RMIConnectorServer.RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE, serverFactory); + env.put("jmx.remote.rmi.server.credential.types", + new String[] { String[].class.getName(), String.class.getName() }); Registry registry = new JmxRegistry(Integer.valueOf(jmxPort), null, serverFactory, "jmxrmi"); JMXServiceURL url = new JMXServiceURL(String.format("service:jmx:rmi://localhost/jndi/rmi://localhost:%s/jmxrmi", jmxPort)); @SuppressWarnings("resource")