This is an automated email from the ASF dual-hosted git repository.
liaoxin01 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 1c05bf57e18 [fix](security) Add auth and config gate for
_stream_load_forward endpoint (#64935)
1c05bf57e18 is described below
commit 1c05bf57e18411d8b9af985283d0fd29cd36ab7b
Author: Xin Liao <[email protected]>
AuthorDate: Tue Jun 30 15:11:44 2026 +0800
[fix](security) Add auth and config gate for _stream_load_forward endpoint
(#64935)
## Summary
- **SSRF fix**: `_stream_load_forward` BE endpoint was registered
unconditionally without authentication, allowing unauthenticated SSRF
attacks
- Add BE config `enable_group_commit_streamload_be_forward` (default
`false`) to gate endpoint registration, matching the existing FE config
name
---
be/src/common/config.cpp | 2 ++
be/src/common/config.h | 2 ++
be/src/service/http/action/stream_load_forward_handler.cpp | 12 ++++++++++++
be/src/service/http/action/stream_load_forward_handler.h | 8 +++++---
be/src/service/http_service.cpp | 2 +-
.../load_p0/stream_load/test_group_commit_redirect.groovy | 1 +
6 files changed, 23 insertions(+), 4 deletions(-)
diff --git a/be/src/common/config.cpp b/be/src/common/config.cpp
index b521fa57ec3..2d7d2edb821 100644
--- a/be/src/common/config.cpp
+++ b/be/src/common/config.cpp
@@ -273,6 +273,8 @@ DEFINE_mInt32(download_low_speed_limit_kbps, "50");
DEFINE_mInt32(download_low_speed_time, "300");
// whether to download small files in batch
DEFINE_mBool(enable_batch_download, "true");
+// whether to enable stream load forward endpoint for cloud group commit
+DEFINE_mBool(enable_group_commit_streamload_be_forward, "false");
// whether to check md5sum when download
DEFINE_mBool(enable_download_md5sum_check, "false");
// download binlog meta timeout, default 30s
diff --git a/be/src/common/config.h b/be/src/common/config.h
index 0b415ed5d2c..016248f94e0 100644
--- a/be/src/common/config.h
+++ b/be/src/common/config.h
@@ -330,6 +330,8 @@ DECLARE_mInt32(download_low_speed_limit_kbps);
DECLARE_mInt32(download_low_speed_time);
// whether to download small files in batch.
DECLARE_mBool(enable_batch_download);
+// whether to enable stream load forward endpoint for cloud group commit
+DECLARE_mBool(enable_group_commit_streamload_be_forward);
// whether to check md5sum when download
DECLARE_mBool(enable_download_md5sum_check);
// download binlog meta timeout
diff --git a/be/src/service/http/action/stream_load_forward_handler.cpp
b/be/src/service/http/action/stream_load_forward_handler.cpp
index c1dfcd0b025..93c4011224e 100644
--- a/be/src/service/http/action/stream_load_forward_handler.cpp
+++ b/be/src/service/http/action/stream_load_forward_handler.cpp
@@ -31,6 +31,18 @@
namespace doris {
int StreamLoadForwardHandler::on_header(HttpRequest* req) {
+ if (!config::enable_group_commit_streamload_be_forward) {
+ HttpChannel::send_reply(req, HttpStatus::FORBIDDEN,
+ "Stream load forward is disabled. "
+ "Set
enable_group_commit_streamload_be_forward=true to enable.");
+ return -1;
+ }
+
+ int auth_ret = HttpHandlerWithAuth::on_header(req);
+ if (auth_ret != 0) {
+ return auth_ret;
+ }
+
std::ostringstream params_info;
const auto* params = req->params();
for (const auto& param : *params) {
diff --git a/be/src/service/http/action/stream_load_forward_handler.h
b/be/src/service/http/action/stream_load_forward_handler.h
index 4c4190478df..6d8d14cc924 100644
--- a/be/src/service/http/action/stream_load_forward_handler.h
+++ b/be/src/service/http/action/stream_load_forward_handler.h
@@ -25,7 +25,8 @@
#include <string>
#include "common/status.h"
-#include "service/http/http_handler.h"
+#include "runtime/exec_env.h"
+#include "service/http/http_handler_with_auth.h"
#include "service/http/http_request.h"
#include "util/byte_buffer.h"
@@ -98,9 +99,10 @@ private:
// Stream Load request forward handler
// Forwards Stream Load requests to other BE nodes
// Supports streaming forward, maintains original request path format:
/api/{db}/{table}/_stream_load_forward
-class StreamLoadForwardHandler : public HttpHandler {
+class StreamLoadForwardHandler : public HttpHandlerWithAuth {
public:
- StreamLoadForwardHandler() = default;
+ explicit StreamLoadForwardHandler(ExecEnv* exec_env)
+ : HttpHandlerWithAuth(exec_env, TPrivilegeHier::GLOBAL,
TPrivilegeType::LOAD) {}
~StreamLoadForwardHandler() override = default;
void handle(HttpRequest* req) override;
diff --git a/be/src/service/http_service.cpp b/be/src/service/http_service.cpp
index 2172c0ebbd7..dadae720a14 100644
--- a/be/src/service/http_service.cpp
+++ b/be/src/service/http_service.cpp
@@ -144,7 +144,7 @@ Status HttpService::start() {
streamload_2pc_action);
// register stream load forward handler
- auto* forward_handler = _pool.add(new StreamLoadForwardHandler());
+ auto* forward_handler = _pool.add(new StreamLoadForwardHandler(_env));
_ev_http_server->register_handler(HttpMethod::PUT,
"/api/{db}/{table}/_stream_load_forward",
forward_handler);
diff --git
a/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
b/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
index 75002e2ac3e..28c8db5f1a8 100644
---
a/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
+++
b/regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy
@@ -93,6 +93,7 @@ suite('test_group_commit_redirect', 'docker') {
options.beNum = 3
options.cloudMode = true
options.beConfigs.add('enable_java_support=false')
+ options.beConfigs.add('enable_group_commit_streamload_be_forward=true')
options.feConfigs.add('enable_group_commit_streamload_be_forward=true')
docker(options) {
// get fe and be info
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
