[contrueCT]

Purpose of the PR

Fixes #3412.

A Gremlin read against HStore can fail while a new gRPC transport reads io.grpc.netty.shaded.io.grpc.netty.useCustomAllocator: HugeSecurityManager rejects the internal read, causing a channel panic and HTTP 500. The read happens on every allocator invocation, so startup warm-up does not prevent later failures.

Main Changes

• Add this exact, non-sensitive boolean flag to the existing property-read whitelist. Gremlin scripts may read this flag as well. No wildcard access to gRPC properties is granted, and production permission checks no longer depend on a gRPC internal class or method name.
• Add regression tests using the real gRPC dependency, GremlinGroovyScriptEngine.eval(), and JVM security manager. Cover both Gremlin/task workers, heap/direct allocators, permitted direct flag reads, denied sensitive and unrelated/prefix-matched property reads, denied enumeration, and denied sensitive reads after an allowed allocator call.
• Document the precise property-read policy in docs/server-runtime.md.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests.
• Need tests and can be verified as follows:

Validated on Temurin 17.0.20.1, macOS aarch64, against master f04d5cc8fc2fbd849d6aeef3f111e717a1f8f90d and its grpc-netty-shaded 1.55.3 dependency:

mvn editorconfig:format
mvn clean compile -Dmaven.javadoc.skip=true
mvn test -pl hugegraph-server/hugegraph-core -am \
  '-Dtest=HugeSecurityManager*Test' \
  -Dsurefire.failIfNoSpecifiedTests=false -DfailIfNoTests=false \
  -DskipCommonsTests=true -Dmaven.javadoc.skip=true

Formatting and all-module clean compilation passed. Before the fix, both allocator worker tests reproduce the exact property rejection on unmodified master. After the fix, all 8 tests pass with no skips (7 new regressions and the existing whitelist test).

The focused tests create no network connections and start no database services. Full distributed HStore integration remains to be validated; these results are component regression evidence.

Does this PR potentially affect the following parts?

• Dependencies
• Modify configurations
• The public API
• Other affects: the sandbox permits direct reads of the exact non-sensitive allocator flag; other restricted property reads remain denied.
• Nope

Documentation Status

• Doc - TODO: required documentation is pending; complete it before merging.
• Doc - Done: the property-read policy is documented in this PR.
• Doc - No Need: no user-visible documentation is affected.

Documentation files in this PR or paired hugegraph-doc PR:

• docs/server-runtime.md, "HStore transport configuration".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.27%. Comparing base (608cb1d) to head (796789e).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3413      +/-   ##
============================================
- Coverage     57.27%   57.27%   -0.01%     
- Complexity     6577     6947     +370     
============================================
  Files           776      776              
  Lines         68881    68876       -5     
  Branches       9431     9431              
============================================
- Hits          39449    39446       -3     
  Misses        25804    25804              
+ Partials       3628     3626       -2     

Flag	Coverage Δ		*Carryforward flag
commons	96.37% <ø> (ø)		Carriedforward from 0d9c2b3
hstore	36.09% <ø> (+<0.01%)	⬆️	Carriedforward from 0d9c2b3
pd	52.17% <ø> (+<0.01%)	⬆️	Carriedforward from 0d9c2b3
server_hbase	42.18% <ø> (+<0.01%)	⬆️	Carriedforward from 0d9c2b3
server_memory	56.07% <ø> (+0.08%)	⬆️
server_rocksdb	42.70% <ø> (+0.04%)	⬆️
store	33.14% <ø> (ø)		Carriedforward from 0d9c2b3

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bitflicker64]

Blocking: no. Score: 9/10. Summary: the exemption matches the per-call useCustomAllocator read in shaded gRPC 1.55.3 Utils.getByteBufAllocator, and a reconnect from a Gremlin thread under HugeSecurityManager fails on master and reaches READY at this head, while direct script reads stay denied.

[imbajin]

Blocking: no. Summary: The property exception matches the shaded gRPC allocator's per-call read and retains the direct-script property restrictions. No actionable issues found. Evidence: Three independent source reviews; gRPC 1.55.3 bytecode inspection; exact-head Java 17 CI confirms all seven allocator regression tests and the existing security test pass without skips. Full distributed HStore transport acceptance was not rerun. Codecov project and patch failures remain non-blocking quality signals. Score: 8.6/10.

[bitflicker64]

Blocking: no. Score: 9/10. Summary: the exact whitelist entry matches the per-call System.getProperty in shaded gRPC Utils.getByteBufAllocator, and the shaded NettyChannelProvider wins provider selection over the unshaded jar on the server classpath. Other property reads and System.getProperties() stay denied, and the 7 new tests run and pass in exact-head CI.

[imbajin]

Blocking: no. Summary: The exact allocator-property whitelist resolves the repeated gRPC property read while preserving restrictions on unrelated properties and enumeration. No actionable issues found. Evidence: Three independent source reviews and gRPC 1.55.3 bytecode inspection; exact-head Java 17 CI confirms all seven allocator regressions and the existing security test pass without skips. Full distributed HStore integration was not rerun. Score: 8.8/10.

[bitflicker64]

Automated review summary: score 10/10, no confirmed introduced defects

Reviewed head: 796789eed0fea54c4b9bfdb30c969dbfeacda6ad (diff base f04d5cc8). This is a multi-agent review coordinated through HG-review-team. All four review lanes have reported: Codex, Claude, Copilot and AGY. None found an introduced defect.

What changed: one exact key, io.grpc.netty.shaded.io.grpc.netty.useCustomAllocator, is added to WHITE_SYSTEM_PROPERTIES. checkPropertyAccess still matches with Set.contains, so similar or prefixed keys and sensitive properties are still denied. checkPropertiesAccess is unchanged.

Evidence:

• Root cause: javap on grpc-netty-shaded-1.55.3 shows that Utils.getByteBufAllocator(boolean) reads this property on every call. Warming the allocator up at startup therefore cannot avoid the error reported in [Bug] Gremlin sandbox blocks HStore gRPC allocator configuration reads #3412.
• Tests on JDK 17 (run independently by the Claude and AGY lanes): at this head, HugeSecurityManagerGrpcTest passes 7/7. With the base HugeSecurityManager.java and the new tests, 4 of 7 fail with Not allowed to access system property(...useCustomAllocator) via Gremlin, so the new tests do catch the regression.

Not covered by this PR, and not counted against it:

• When a gRPC allocator holder is initialized for the first time, it also reads ...netty.allocator.maxOrder.
• checkConnect denies connections from Gremlin threads.

Both behave the same at base and at head, and neither was shown to be reachable on the normal HStore path, where the PD client creates its channels outside Gremlin.

Limits: no reviewer ran a live HStore/PD cluster or an end-to-end Gremlin-over-HTTP reproduction. The evidence above is component-level only.