Page History

...

This particular ability was not limited to specific calls, but it allowed any method invocation on the objects, including setters (which, by definition, change the object itself) and, through reflection, internal Geode and JDK methods available on the classpath. Due to the range of methods that could be invoked, several security risks were identified that could impact the integrity of the data, the integrity of the region, and/or the integrity of the platform running Geode. As part of the effort to mitigate these security flaws, GEODE-3247 was created and fixed shortly after, so from that moment on in Geode 1.3.0 such that the OQL engine now started working operates through an all or nothing approach, meaning that : when a SecurityManager is enabled Geode throws a NotAuthorizedException whenever a method, not belonging to the following whitelist, is invoked:

...