xxjingcd commented on PR #13464:
URL:
https://github.com/apache/dolphinscheduler/pull/13464#issuecomment-1410236729
> I don't think we need this PR, we have removed the security check in
#13280.
>
> Since the logPath is controlled by DS internal, it will not bring CVE.
"DS interval" is not mean security. Due DS is a distributed system，"DS
interval" is actually based on network communications which can be attacked
easily;
I think we should have a more detailed discussion. Please turn to issue
#13460 . And I will provide a attack example;
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
