fix: fix inconsistent naming pattern by JisoLya · Pull Request #2945 · apache/hugegraph

JisoLya · 2026-01-27T09:30:11Z

Currently, the configuration keys in rest-server.properties use snake_case (e.g., server_port), which is inconsistent with the naming convention expected by ServerOptions.java. This mismatch causes the following issues:

User-defined configurations are ignored at startup.
The server defaults to hardcoded values in ServerOptions.java.

Terminal logs show warnings such as: "arthas.xxxx is redundant ...", indicating that the properties are not being recognized or registered.

…ng pattern

codecov · 2026-01-27T09:40:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 31.96%. Comparing base (03e6b8e) to head (4f3bfab).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #2945      +/-   ##
============================================
- Coverage     36.80%   31.96%   -4.85%     
- Complexity      338      500     +162     
============================================
  Files           805      816      +11     
  Lines         68587    69738    +1151     
  Branches       9029     9226     +197     
============================================
- Hits          25241    22289    -2952     
- Misses        40653    44972    +4319     
+ Partials       2693     2477     -216

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR enhances security for Arthas debugging endpoints by restricting remote access and standardizing configuration naming patterns across the codebase.

Changes:

Added localhost-only access restriction to the store node's arthasstart endpoint
Standardized Arthas configuration property names from snake_case to camelCase (e.g., arthas.telnet_port → arthas.telnetPort)
Changed default Arthas IP binding from 0.0.0.0 to 127.0.0.1 and expanded disabled commands to include jad,ognl,vmtool

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
hugegraph-store/hg-store-node/src/main/resources/application.yml	Added Arthas configuration with localhost-only IP binding and expanded disabled commands
hugegraph-store/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java	Added remote access check to arthasstart endpoint and new forbiddenMap helper method
hugegraph-store/hg-store-node/src/main/java/org/apache/hugegraph/store/node/AppConfig.java	Updated default values for Arthas IP and disabled commands
hugegraph-server/hugegraph-dist/src/assembly/static/conf/rest-server.properties	Renamed Arthas properties to camelCase and updated default values
hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/config/ServerOptions.java	Updated default values for Arthas IP binding and disabled commands

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-03-01T21:06:17Z

Due to the lack of activity, the current pr is marked as stale and will be closed after 180 days, any update will remove the stale label

VGalaxies

Review summary

Blocking: yes
Summary: A success path can now throw while constructing the response because nullable payloads are passed into Map.of().
Evidence:
- Static review of git diff origin/master...HEAD and PartitionAPI.ok(...).

imbajin

Blocking: yes. Summary: Two current-head issues remain: the new admin role guard does not protect /arthas in the default no-auth configuration, and the store distribution config does not expose the newly added Arthas settings. Evidence: static review of the PR diff at head 4f3bfab plus current source for AuthenticationFilter, GraphManager, HugeAuthenticator, and store assembly config.

imbajin · 2026-07-10T13:20:26Z

 @Path("arthas")
 @Singleton
 @Tag(name = "ArthasAPI")
+@RolesAllowed("admin")


Blocking: yes. Summary: This annotation does not protect PUT /arthas in the default no-auth configuration because anonymous requests are treated as admin. Please add an explicit localhost/no-auth guard here, or require authentication before calling ArthasAgent.attach(...). Evidence: GraphManager.requireAuthentication() returns false when no authenticator is configured; AuthenticationFilter.authenticate() then returns User.ANONYMOUS; HugeAuthenticator.User.ANONYMOUS is constructed with ROLE_ADMIN.

imbajin · 2026-07-10T13:20:26Z

  level:
    root: info
+
+arthas:


Blocking: no. Summary: These node-resource Arthas defaults are not reflected in the store distribution config, so packaged users will not see or tune the new settings in conf/application.yml. Please add the same arthas section to hugegraph-store/hg-store-dist/src/assembly/static/conf/application.yml. Evidence: the store assembly includes ${assembly.static.dir}/conf, and start-hugegraph-store.sh loads ${CONF}/application.yml; the dist application.yml currently ends at the logging section without any arthas keys.

VGalaxies

Review summary

Blocking: yes
Summary: The localhost restriction remains proxy-bypassable; existing response and configuration compatibility concerns are already covered by current-head comments.
Evidence:
- Static comparison via git diff origin/master...HEAD, git show origin/master:<path>, and repository-wide rg
- git diff --check origin/master...HEAD passed

VGalaxies · 2026-07-11T18:51:07Z

+        // NOTE: If behind a reverse proxy (e.g., Nginx), getRemoteAddr() returns the proxy's IP.
+        // Ensure the proxy is configured to block untrusted external access.
+        String remoteAddr = getCleanIp(request.getRemoteAddr());
+        boolean isLocalRequest =


High: Local proxies bypass the localhost restriction

hugegraph-store/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java:200

Evidence

getRemoteAddr() identifies the immediate peer, so an external request forwarded by a same-host reverse proxy appears as 127.0.0.1 and reaches ArthasAgent.attach() at line 213. No authentication interceptor or security configuration exists in hg-store-node.

Impact

Remote callers can still trigger dynamic agent attachment in a common reverse-proxy deployment despite the endpoint claiming localhost-only access.

Requested fix

Do not use peer IP as the sole authorization boundary; require authenticated administrative access or expose this endpoint through a separate listener explicitly bound to loopback.

JisoLya added 2 commits January 27, 2026 16:30

sec(store, server): disable remote access for arthasstart

b105e2c

fix(server): arthas configuration is ignored due to inconsistent nami…

bda5d52

…ng pattern

dosubot Bot added size:M This PR changes 30-99 lines, ignoring generated files. store Store module labels Jan 27, 2026

github-project-automation Bot added this to HugeGraph PD-Store Tasks Jan 27, 2026

github-project-automation Bot moved this to In progress in HugeGraph PD-Store Tasks Jan 27, 2026

imbajin requested a review from Copilot January 27, 2026 09:50

Copilot started reviewing on behalf of imbajin January 27, 2026 09:51 View session

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/config/ServerOptions.java

imbajin reviewed Jan 27, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

Copilot AI reviewed Jan 27, 2026

View reviewed changes

fix: unify the return value and block non-web request

339117d

JisoLya requested a review from imbajin January 29, 2026 07:44

imbajin requested a review from Copilot January 29, 2026 07:55

Copilot started reviewing on behalf of imbajin January 29, 2026 07:55 View session

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread hugegraph-server/hugegraph-dist/src/assembly/static/conf/rest-server.properties

imbajin reviewed Jan 29, 2026

View reviewed changes

Comment thread hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/config/ServerOptions.java

Copilot AI reviewed Jan 29, 2026

View reviewed changes

JisoLya added 2 commits January 29, 2026 18:05

fix: unify the return value and block non-web request

5e5063d

trigger-ci

a4abb37

JisoLya changed the title ~~sec(store, server): disable remote access for arthasstart and fix inconsistent naming pattern~~ fix: fix inconsistent naming pattern Jan 29, 2026

JisoLya requested a review from imbajin January 30, 2026 08:02

github-actions Bot added the inactive label Mar 1, 2026

imbajin reviewed Mar 10, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

imbajin reviewed Mar 10, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

imbajin reviewed Mar 10, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java

VGalaxies reviewed Jun 25, 2026

View reviewed changes

Comment thread ...ore/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java Outdated

JisoLya added 2 commits July 6, 2026 17:53

Merge branch 'apache:master' into arthas-sec

e03602f

fix: avoid null value of Map.of()

4f3bfab

JisoLya requested review from VGalaxies and imbajin July 6, 2026 10:46

imbajin reviewed Jul 10, 2026

View reviewed changes

VGalaxies reviewed Jul 11, 2026

View reviewed changes

Uh oh!

Conversation

JisoLya commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

VGalaxies left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

imbajin left a comment

Choose a reason for hiding this comment

Uh oh!

imbajin Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

imbajin Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

VGalaxies left a comment

Choose a reason for hiding this comment

Uh oh!

VGalaxies Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JisoLya commented Jan 27, 2026 •

edited

Loading

codecov Bot commented Jan 27, 2026 •

edited

Loading