Configuring the Graph sandbox

DSE Graph has sandbox rules enabled by default to prevent malicious code execution in the JVM that could harm a DSE instance. Sandbox rules are defined to both blacklist (disallow execution) and whitelist (allow execution) packages, superclasses and types. The default sandbox rules may be overridden in the dse.yaml file. The sandbox rules are applied in the following order:

1. blacklist_supers, including all classes that implement or extend the listed items
2. blacklist_packages, including all sub-packages
3. whitelist_packages, including all sub-packages
4. whitelist_types, not including sub-classes, but only the specified type
5. whitelist_supers, including all classes that implement or extend the listed items

Any types not specified in the whitelist are blocked by default. If an item is blacklisted, it cannot be placed in the whitelist unless it is removed from the blacklist; an error occurs and the item is blocked.

An example of possible whitelisted and blacklisted items in the gremlin_server section of the dse.yaml file:

gremlin_server:
     port: 8182
     threadPoolWorker: 2
     gremlinPool: 0
        scriptEngines:
            gremlin-groovy:
                config:
 #                  sandbox_enabled: false
                       sandbox_rules:
                            whitelist_packages:
                            - org.apache.tinkerpop.gremlin.process
                            - java.nio
                        whitelist_types:
                            - java.lang.String
                            - java.lang.Boolean
                            - com.datastax.bdp.graph.spark.SparkSnapshotBuilderImpl
                            - com.datastax.dse.graph.api.predicates.Search
                        whitelist_supers:
                            - groovy.lang.Script
                            - java.lang.Number
                            - java.util.Map
                            - org.apache.tinkerpop.gremlin.process.computer.GraphComputer
                        blacklist_packages:
                            - java.io
                            - org.apache.tinkerpop.gremlin.structure.io
                            - org.apache.tinkerpop.gremlin.groovy.jsr223
                            - java.nio.channels
                        blacklist_supers:
                            - java.lang.System
                            - java.io.File
                            - org.apache.tinkerpop.gremlin.structure.Transaction