{"record":{"id":"0a12a345a8a573fe","repo":"apache/cassandra","slug":"access-denied-perm","errorCode":null,"errorMessage":"access denied: + perm","messagePattern":"access denied: \\+ perm","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java","lineNumber":249,"sourceCode":"\n        super.checkPermission(perm);\n    }\n\n    public void checkPermission(Permission perm, Object context)\n    {\n        if (isSecuredThread())\n            super.checkPermission(perm, context);\n    }\n\n    public void checkPackageAccess(String pkg)\n    {\n        if (!isSecuredThread())\n            return;\n\n        if (!((SecurityThreadGroup) Thread.currentThread().getThreadGroup()).isPackageAllowed(pkg))\n        {\n            RuntimePermission perm = new RuntimePermission(\"accessClassInPackage.\" + pkg);\n            throw new AccessControlException(\"access denied: \" + perm, perm);\n        }\n    }\n}\n","sourceCodeStart":231,"sourceCodeEnd":253,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java#L231-L253","documentation":"ThreadAwareSecurityManager.checkPackageAccess throws AccessControlException when a secured UDF thread attempts to load a class from a package that is not on the allowed-package whitelist. Cassandra sandboxes user-defined functions by restricting which Java packages their code can touch; any import/reflection access to a disallowed package triggers this.","triggerScenarios":"UDF bytecode references a class in a package not listed in the UDF whitelist (e.g. java.io.File, arbitrary application packages). At class-linking time the JVM calls checkPackageAccess on the secured thread, and ((SecurityThreadGroup) ...).isPackageAllowed(pkg) returns false (src/java/org/apache/cassandra/security/ThreadAwareSecurityManager.java:249).","commonSituations":"UDFs importing utility libraries outside the allowed set; after upgrading Cassandra the default package whitelist shrank; attempts to do file/network I/O from a UDF.","solutions":["Rewrite the UDF to only use classes from allowed packages (java.lang, java.math, java.nio, java.text, java.util, org.apache.cassandra.*).","Add the needed package to the UDF whitelist via the scripted/allowed-packages configuration for UDFs (with awareness of security implications).","Move the disallowed logic out of the UDF into client-side code.","Use a UDF language (e.g. Java with restricted imports) that avoids the offending package."],"exampleFix":"// before (UDF body)\nimport java.io.File;  // AccessControlException: accessClassInPackage.java.io\nFile f = new File(path);\n// after\n// use only whitelisted APIs, e.g. operate on column values with java.lang/java.util only","handlingStrategy":"validation","validationCode":"// Before importing a UDF, check that all referenced packages are on the allowed list\nboolean allowed = Arrays.stream(referencedPackages).allMatch(pkg -> ALLOWED_UDF_PACKAGES.stream().anyMatch(p -> pkg.equals(p) || pkg.startsWith(p + \".\")));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Write UDFs using only java.lang, java.math, java.nio, java.text, java.util and org.apache.cassandra.* APIs","Test UDFs on a dev cluster with the same whitelist configuration as production","Avoid file I/O, networking, and reflection inside UDFs","Track whitelist changes across Cassandra upgrades"],"tags":["security","udf","sandbox","package-access"],"backgroundTag":"insufficient-permissions","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}