{"record":{"id":"026f5fae2c87b3e6","repo":"apache/cassandra","slug":"allowing-java-lang-system-access-in-udfs-is-dang","errorCode":null,"errorMessage":"Allowing java.lang.System.* access in UDFs is dangerous and not recommended. Set allow_extra_insecure_udfs: false to disable.","messagePattern":"Allowing java\\.lang\\.System\\.\\* access in UDFs is dangerous and not recommended\\. Set allow_extra_insecure_udfs: false to disable\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":1116,"sourceCode":"        indexSummaryCapacityInMiB = (conf.index_summary_capacity == null)\n                                    ? Math.max(1, (int) (Runtime.getRuntime().totalMemory() * 0.05 / 1024 / 1024))\n                                    : conf.index_summary_capacity.toMebibytes();\n\n        if (indexSummaryCapacityInMiB < 0)\n            throw new ConfigurationException(\"index_summary_capacity option was set incorrectly to '\"\n                                             + conf.index_summary_capacity.toString() + \"', it should be a non-negative integer.\", false);\n\n        // we need this assignment for the Settings virtual table - CASSANDRA-17735\n        conf.index_summary_capacity = new DataStorageSpec.LongMebibytesBound(indexSummaryCapacityInMiB);\n\n        if (conf.user_defined_functions_fail_timeout.toMilliseconds() < conf.user_defined_functions_warn_timeout.toMilliseconds())\n            throw new ConfigurationException(\"user_defined_functions_warn_timeout must less than user_defined_function_fail_timeout\", false);\n\n        if (!conf.allow_insecure_udfs && !conf.user_defined_functions_threads_enabled)\n            throw new ConfigurationException(\"To be able to set enable_user_defined_functions_threads: false you need to set allow_insecure_udfs: true - this is an unsafe configuration and is not recommended.\");\n\n        if (conf.allow_extra_insecure_udfs)\n            logger.warn(\"Allowing java.lang.System.* access in UDFs is dangerous and not recommended. Set allow_extra_insecure_udfs: false to disable.\");\n\n        if (conf.scripted_user_defined_functions_enabled)\n            throw new ConfigurationException(\"JavaScript user-defined functions were removed in CASSANDRA-18252. \" +\n                                             \"Hooks are planned to be introduced as part of CASSANDRA-17280\");\n\n        if (conf.commitlog_segment_size.toMebibytes() == 0)\n            throw new ConfigurationException(\"commitlog_segment_size must be positive, but was \"\n                                             + conf.commitlog_segment_size.toString(), false);\n        else if (conf.commitlog_segment_size.toMebibytes() >= 2048)\n            throw new ConfigurationException(\"commitlog_segment_size must be smaller than 2048, but was \"\n                                             + conf.commitlog_segment_size.toString(), false);\n\n        if (conf.max_mutation_size == null)\n            conf.max_mutation_size = new DataStorageSpec.IntKibibytesBound(conf.commitlog_segment_size.toKibibytes() / 2);\n        else if (conf.commitlog_segment_size.toKibibytes() < 2 * conf.max_mutation_size.toKibibytes())\n            throw new ConfigurationException(\"commitlog_segment_size must be at least twice the size of max_mutation_size / 1024\", false);\n\n        if (conf.native_transport_max_message_size == null)","sourceCodeStart":1098,"sourceCodeEnd":1134,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L1098-L1134","documentation":"A warning logged when allow_extra_insecure_udfs is enabled in cassandra.yaml. This option permits UDF code to access java.lang.System.* (and other unsafe operations) without the sandbox restrictions Cassandra normally enforces, which is dangerous. The message advises disabling the option; startup continues.","triggerScenarios":"Starting a node with allow_extra_insecure_udfs: true; applySimpleConfig logs the warning while validating UDF-related settings (alongside allow_insecure_udfs and user_defined_functions_threads_enabled checks).","commonSituations":"Migrating UDFs from very old Cassandra versions that relied on unrestricted Java UDFs; disabling sandboxing to make legacy UDFs run; copying insecure dev configs into production.","solutions":["Set allow_extra_insecure_udfs: false in cassandra.yaml and rewrite UDFs that need java.lang.System.* access.","Keep UDFs sandboxed; avoid also disabling allow_insecure_udfs / UDF threads unless absolutely required."],"exampleFix":"// cassandra.yaml before\nallow_extra_insecure_udfs: true\n// after\nallow_extra_insecure_udfs: false","handlingStrategy":"validation","validationCode":"if (Boolean.TRUE.equals(yamlConfig.get(\"allow_extra_insecure_udfs\"))) {\n    throw new IllegalStateException(\"allow_extra_insecure_udfs is unsafe; rewrite UDFs instead of disabling the sandbox\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep all *insecure_udfs options false in production","Audit UDF code for java.lang.System.* usage before deploying","Fail security review of configs that disable UDF sandboxing"],"tags":["cassandra","configuration","security","udf"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}