Fix CVE-2017-11467: upgrade OrientDB 2.1.25 → 2.2.37

[Copilot]

Run 24614826683 on 309618da3f (the previous WAL-disable fix) showed the same O(N²) timing pattern (link 7s → relationships 19s → synchronisation_pooledSyncStage 66s → next class killed). So disabling WAL was not the actual remedy.

Real root cause

OrientDB 2.2.37 has STORAGE_MAKE_FULL_CHECKPOINT_AFTER_CLUSTER_CREATE = true by default. After every addCluster() call (i.e. every class/index creation), it performs a full storage checkpoint — fsync()'ing every cluster file plus the WAL. As clusters accumulate, each checkpoint scans/syncs all previously-created clusters, producing the classic O(N²) total cost. On Linux/macOS where fdatasync() is expensive, this turns ~30 schema classes into 5+ minutes; on Windows the same code is fast because NTFS batches writes.

Fix

In DBHelper.checkDB, additionally disable for the schema-setup window:

• STORAGE_MAKE_FULL_CHECKPOINT_AFTER_CLUSTER_CREATE (the dominant cost)
• STORAGE_MAKE_FULL_CHECKPOINT_AFTER_CREATE
• STORAGE_MAKE_FULL_CHECKPOINT_AFTER_OPEN

Originals are captured before and restored in the existing finally block. The WAL flags and the comment block are kept — they were not harmful, just insufficient.

All three flag names verified to exist in OrientDB 2.2.x source (storage.makeFullCheckpoint{AfterCreate,AfterOpen,AfterClusterCreate}).

Tasks

• Re-diagnose run 24614826683 — same O(N²) pattern, WAL fix alone insufficient
• Identify true culprit — full-checkpoint-after-cluster-create runs after each addCluster
• Disable STORAGE_MAKE_FULL_CHECKPOINT_AFTER_CLUSTER_CREATE (+ AFTER_CREATE / AFTER_OPEN) for schema setup; restore in finally
• Verify on next CI run

Original prompt

Problem

CVE-2017-11467 is a critical vulnerability (CVSS 9.8) in OrientDB versions through 2.2.22. OrientDB does not enforce privilege requirements on where, fetchplan, and order by query features, allowing remote unauthenticated attackers to execute arbitrary OS commands via crafted requests.

The repository currently uses orientdb.version = 2.1.25 (defined in the root pom.xml at line ~119), which is vulnerable.

Required Fix

1. In the root pom.xml, update the orientdb.version property from 2.1.25 to at least 2.2.23 (the first patched version). Prefer the latest 2.2.x release if possible.

2. Also update orientdb.studio.version from 1.7.10 to a compatible version.

3. Fix any compilation errors in the openidm-repo-orientdb module caused by API changes between OrientDB 2.1.x and 2.2.x. Key classes to check:

   • ODatabaseDocumentPool (may have been replaced by OPartitionedDatabasePool in 2.2.x)
   • OSimpleVersion
   • Any other deprecated/removed APIs in openidm-repo-orientdb/src/main/java/org/forgerock/openidm/repo/orientdb/impl/

4. Update the legal/THIRDPARTYREADME.txt to reflect the new OrientDB version.

5. Update documentation references to OrientDB version in openidm-doc/src/main/asciidoc/install-guide/chap-install.adoc if applicable.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: предложи исправление CVE-2017-11467

Assistant: ## CVE-2017-11467 в OpenIDM

Проблема: CVE-2017-11467 — критическая уязвимость (CVSS 9.8) в OrientDB, позволяющая удалённое выполнение произвольных команд ОС без аутентификации. OrientDB не проверяет привилегии при использовании where, fetchplan и order by в запросах, что позволяет выполнять Groovy-код через специально сформированные запросы.

Текущая версия в репозитории: orientdb.version = 2.1.25 (уязвимы все версии до 2.2.22 включительно).

Исправление

Необходимо обновить версию OrientDB до 2.2.23 или выше в корневом pom.xml:

<!-- Было: -->
<orientdb.version>2.1.25</orientdb.version>

<!-- Нужно: -->
<orientdb.version>2.2.23</orientdb.version>

Важно: Обновление с 2.1.x на 2.2.x — мажорный переход. Могут потребоваться:

1. Проверка совместимости API — некоторые классы OrientDB (например, ODatabaseDocumentPool, OSimpleVersion) были изменены или удалены в 2.2.x. Нужно проверить компиляцию модуля openidm-repo-orientdb.
2. Миграция данных — формат хранения OrientDB мог измениться между версиями.
3. Обновление OrientDB Studio — текущая версия orientdb.studio.version = 1.7.10, её тоже следует обновить.

Хотите, чтобы я создал Pull Request с этим исправлением?

User: да

Assistant: I've started the process of creating a Pull Request to fix CVE-2017-11467 by upgrading OrientDB. The coding agent is now working on the changes — we're waiting for it to complete the PR. I'll share the link once it's ready.

This pull request was created from Copilot chat.