JQL context validation can execute third-party JQL statements which can be expensive

Summary

JQL context validation can execute third-party JQL statements which can be expensive.
This is done as part of com.atlassian.jira.jql.operand.FunctionOperandHandler.validate method.

Environment

• JQL filter with 3rd party JQL providers: JQL-tricks, Script Runner, etc

Steps to Reproduce

1. Install Script Runner (just an example)
2. Create new JQL with following data and safe as a filter

   issueFunction in subtasksOf('Project = "AG"')
   

3. Creare new board using the mentioned filter
4. Load any issue

Expected Results

JQL will be not executed

Actual Results

JQL was executed

Notes

Potentially any JQL with long and complex statement will cause the problem. So we are aware of the following specific pattens in JQL:

• id in
• key in
• parent in
• filter in
• issue in
• issueFunction in

The following query will help you identifying those JQL function used as filter for Boards in your instance:

// list of Boards with JQL filters
 select rv."ID", rv."NAME", sr.reqcontent from searchrequest sr, "AO_60DB71_RAPIDVIEW" rv where rv."SAVED_FILTER_ID" = sr.id;

Workaround

None