Add reproduction test for v1 admin authz param-duplication bypass#13

Open

markrmiller wants to merge 6 commits into

mainfrom

claude/solr-param-duplication-authz-3O2z7

Commits on May 25, 2026

Add reproduction test for v1 admin authz param-duplication bypass
claude
committed
Add SolrCloud IT showing collection-param does not bypass per-collection read authz
claude
committed
Add SolrCloud IT proving end-to-end duplicate-param authz bypass on collection admin
claude
committed
Add IT: multi-collection param smuggling cannot defeat per-shard re-auth
claude
committed
Add IT confirming custom authz param rules don't see V2 JSON-body params
claude
committed
Add IT: duplicate-param bypass reaches search for non-collection first-value params
claude
committed