solr-conf-drupal

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files from non-whitelisted but plausibly project-owned hosts (github.com/apache and drupal.org) for building configuration files; these are non-executable data files, and the worst case of a swapped source is limited to configuration tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from non-whitelisted but plausibly project-owned hosts (github.com/apache and drupal.org) for building configuration files; these are non-executable data files, and the worst case of a swapped source is limited to configuration tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "https://www.drupal.org/files/issues/2711685-support-solr6-${_pkgname//_/-}-4.patch"
PKGBUILD:21 "http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[0]}.tar.gz"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: James An <james@jamesan.ca>
    
      2
    
      3pkgname=solr-conf-drupal
    
      4_pkgname=search_api_solr
    
      5pkgver=20160708
    
      6_pkgvers=(7.x-1.11
    
      7          8.x-1.0-alpha5)
    
      8pkgrel=2
    
      9pkgdesc="Configuration files to enable Drupal 7.x or 8.x to use Solr 3.x, 4.x, or 5.x as its search provider"
    
      10arch=('any')
    
      11url="http://drupal.org/project/$_pkgname"
    
      12license=('GPL')
    
      13depends=('solr>=3')
    
      14optdepends=(
    
      15  'drupal: Solr client for these configuration files'
    
      16  'aegir: meta-Drupal hosting platform'
    
      17  'solr-undertow: high performance servlet container for Solr')
    
      18# The mapping-ISOLatin1Accent.txt file is identical in all occurrences in the Solr repo across the head of all its supported branches (3-5.x)
    
      19source=("https://raw.githubusercontent.com/apache/lucene-solr/master/solr/example/example-DIH/solr/solr/mapping-ISOLatin1Accent.txt"
    
      20        "https://www.drupal.org/files/issues/2711685-support-solr6-${_pkgname//_/-}-4.patch"
    
      21        "http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[0]}.tar.gz"
    
      22        "http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[1]}.tar.gz")
    
      23md5sums=('9f3c8a60a4f09327fad22aeff082c2b3'
    
      24         '479dea32043f12575838eaa6de62f248'
    
      25         'a8b60845919774521861bdfbe7883a11'
    
      26         '1a2636b8050903114b66ce300c99b50d')
    
      27noextract=("${source[@]%%::*}")
    
      28
    
      29prepare() {
    
      30  for _pkgver in "${_pkgvers[@]}"; do
    
      31    echo $_pkgver
    
      32    ver_drupal="${_pkgver%%-*}"
    
      33    install -dm755 "$ver_drupal"
    
      34    tar --extract --file="$_pkgname-$_pkgver.tar.gz" --strip-components=1 --directory="$ver_drupal" --overwrite
    
      35    [ "$ver_drupal" = "8.x" ] || patch --strip=1 --directory=$ver_drupal < "2711685-support-solr6-${_pkgname//_/-}-4.patch"
    
      36  done
    
      37}
    
      38
    
      39package() {
    
      40  # Traverse and install conf files for Drupal 7.x and 8.x, and for Solr 1.4 (Drupal 8.x only), 3.x, 4.x, and 5.x.
    
      41  for ver_drupal in "${_pkgvers[@]%%-*}"; do
    
      42    for ver_solr in $(basename -a $ver_drupal/solr-conf/*); do
    
      43      for file in $(basename -a $ver_drupal/solr-conf/$ver_solr/*); do
    
      44        install -Dm644 "$ver_drupal/solr-conf/$ver_solr/$file" "$pkgdir/etc/solr/configsets/solr-$ver_solr-drupal-$ver_drupal/conf/$file"
    
      45      done
    
      46      install -Dm644 mapping-ISOLatin1Accent.txt "$pkgdir/etc/solr/configsets/solr-$ver_solr-drupal-$ver_drupal/conf/mapping-ISOLatin1Accent.txt"
    
      47    done
    
      48  done
    
      49}
    
      50
    
      51#~ Create new core with drupal config set
    
      52#~ http://localhost:8983/solr/admin/cores?action=CREATE&name=coreX&configSet=solr-5.x-drupal-7.x
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2