solr-conf-drupal
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source files from non-whitelisted but plausibly project-owned hosts (github.com/apache and drupal.org) for building configuration files; these are non-executable data files, and the worst case of a swapped source is limited to configuration tampering, not code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from non-whitelisted but plausibly project-owned hosts (github.com/apache and drupal.org) for building configuration files; these are non-executable data files, and the worst case of a swapped source is limited to configuration tampering, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
"https://www.drupal.org/files/issues/2711685-support-solr6-${_pkgname//_/-}-4.patch" -
PKGBUILD:21
"http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[0]}.tar.gz"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: James An <james@jamesan.ca>
2
3
pkgname=solr-conf-drupal
4
_pkgname=search_api_solr
5
pkgver=20160708
6
_pkgvers=(7.x-1.11
7
8.x-1.0-alpha5)
8
pkgrel=2
9
pkgdesc="Configuration files to enable Drupal 7.x or 8.x to use Solr 3.x, 4.x, or 5.x as its search provider"
10
arch=('any')
11
url="http://drupal.org/project/$_pkgname"
12
license=('GPL')
13
depends=('solr>=3')
14
optdepends=(
15
'drupal: Solr client for these configuration files'
16
'aegir: meta-Drupal hosting platform'
17
'solr-undertow: high performance servlet container for Solr')
18
# The mapping-ISOLatin1Accent.txt file is identical in all occurrences in the Solr repo across the head of all its supported branches (3-5.x)
19
source=("https://raw.githubusercontent.com/apache/lucene-solr/master/solr/example/example-DIH/solr/solr/mapping-ISOLatin1Accent.txt"
20
"https://www.drupal.org/files/issues/2711685-support-solr6-${_pkgname//_/-}-4.patch"
21
"http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[0]}.tar.gz"
22
"http://ftp.drupal.org/files/projects/$_pkgname-${_pkgvers[1]}.tar.gz")
23
md5sums=('9f3c8a60a4f09327fad22aeff082c2b3'
24
'479dea32043f12575838eaa6de62f248'
25
'a8b60845919774521861bdfbe7883a11'
26
'1a2636b8050903114b66ce300c99b50d')
27
noextract=("${source[@]%%::*}")
28
29
prepare() {
30
for _pkgver in "${_pkgvers[@]}"; do
31
echo $_pkgver
32
ver_drupal="${_pkgver%%-*}"
33
install -dm755 "$ver_drupal"
34
tar --extract --file="$_pkgname-$_pkgver.tar.gz" --strip-components=1 --directory="$ver_drupal" --overwrite
35
[ "$ver_drupal" = "8.x" ] || patch --strip=1 --directory=$ver_drupal < "2711685-support-solr6-${_pkgname//_/-}-4.patch"
36
done
37
}
38
39
package() {
40
# Traverse and install conf files for Drupal 7.x and 8.x, and for Solr 1.4 (Drupal 8.x only), 3.x, 4.x, and 5.x.
41
for ver_drupal in "${_pkgvers[@]%%-*}"; do
42
for ver_solr in $(basename -a $ver_drupal/solr-conf/*); do
43
for file in $(basename -a $ver_drupal/solr-conf/$ver_solr/*); do
44
install -Dm644 "$ver_drupal/solr-conf/$ver_solr/$file" "$pkgdir/etc/solr/configsets/solr-$ver_solr-drupal-$ver_drupal/conf/$file"
45
done
46
install -Dm644 mapping-ISOLatin1Accent.txt "$pkgdir/etc/solr/configsets/solr-$ver_solr-drupal-$ver_drupal/conf/mapping-ISOLatin1Accent.txt"
47
done
48
done
49
}
50
51
#~ Create new core with drupal config set
52
#~ http://localhost:8983/solr/admin/cores?action=CREATE&name=coreX&configSet=solr-5.x-drupal-7.x
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |