jacktengg opened a new pull request, #70207:
URL: https://github.com/apache/doris/pull/70207
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
BE passes configured paths to a shell when it runs profiling tools. The
shell can treat parts of those paths as commands. For example, `profile$(printf
injected).heap` becomes `profileinjected.heap` before the profiling tool starts.
This change quotes each variable argument in the jeprof, pprof, and perf
commands. It also quotes the tool paths and the flame graph output path. The
same rule applies to Python version checks, environment creation, and package
lists. Double quotes alone do not stop command substitution in these Python
paths.
The heap dump code copies `jeprofile_dir` under the configuration update
lock. Directory creation and file creation then use the same copy. The shell
command helper rejects NUL bytes before it calls `popen`. The pprof content
path removes the temporary file that it created.
Related paths checked:
- `/jeheap/dump`: a mutable `jeprofile_dir` reaches the jeprof command.
- `/pprof/heap?readable=1` and `/pprof/profile?type=text`: configured paths
reach pprof.
- `/pprof/profile?type=flamegraph`: configured paths reach perf, both
pipeline tools, and file redirection.
- Python environment checks and `get_python_packages`: operator paths reach
shell commands.
- The HTTP `type addr2line` command has no variable argument.
- The CDC launcher passes an argument array to `execv`.
The threat model classifies BE 8040 as an internal port. Network isolation
remains required. Anonymous access to this port is out of model under sections
4.3 and 4.4. This change removes command interpretation from path values. It
does not change the HTTP authentication default. The Python paths require
operator configuration and Python UDF support.
### Release note
BE now quotes paths in profiling and Python environment commands. The BE
shell command no longer interprets shell characters in those arguments.
### Check List (For Author)
- Test:
- ASAN BE build: `./build.sh --be -j32` passed.
- Unit tests: 45 tests passed in `AgentUtilsTest`, `ProfilerCommandTest`,
and `PythonEnvTest`.
- clang-format 16, clang-tidy, and BE header hygiene checks passed.
- Manual test: the local BE accepted and returned the path unchanged. The
original configuration was restored.
- Manual test: ASAN HTTP profiling handlers returned their expected
disabled responses.
- Manual test: the installed jeprof read an empty profile with quotes and
shell characters in its path. It returned `No nodes to print`.
- Behavior changed: Yes. Shell characters in paths remain part of the path.
Commands with NUL bytes fail before they start.
- Does this need documentation: No. The API and configuration names are
unchanged.
### Minimal reproduction
The unit tests use small local scripts as profiling tools. They pass paths
with spaces, repeated quotes, and `$(printf injected)` through the production
code. The scripts must receive the original paths. These tests need no tables
or rows.
```sh
./run-be-ut.sh --run
--filter='AgentUtilsTest.*:ProfilerCommandTest.*:PythonEnvTest.*' -j32
```
ASAN builds disable the HTTP sampling handlers. The tests call the
production conversion functions directly to check the shell boundary.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
