[MNT-22392] (#1188)

added invariant configuration for backup location

search-services/alfresco-search/src/main/resources/solr/instance/templates/rerank/conf/solrconfig.xml

@@ -1176,6 +1176,15 @@
          <str name="pollInterval">00:00:60</str>
        </lst>
     -->
+
+      <!--
+      This invariant is needed to prevent the usage of location parameter in the replication handler APIs.
+      There is no validation for location parameter. This results in a vulnerability described in https://nvd.nist.gov/vuln/detail/CVE-2020-13941
+      -->
+      <lst name="invariants">
+          <str name="location">${solr.backup.dir:.}</str>
+      </lst>
+
   </requestHandler>
 
   <!-- Search Components

search-services/alfresco-search/src/main/resources/solr/instance/templates/rerank/conf/solrcore.properties

@@ -234,6 +234,13 @@ solr.request.content.compress=false
 #
 solr.initial.transaction.range=0-2000
 
+
+# Backup
+# The path where the backup will be created.
+# If the path is not absolute then the backup path will be relative to Solr’s instance directory.
+# By default, backups will be placed in the solr's instance directory.
+# solr.backup.dir=./backup
+
 #
 # Start indexing from a given Transaction Id, skipping the previous ones
 # WARNING: This is a DEVELOPMENT feature and it must not be used in PROD environments