github-code-scanning[bot] commented on code in PR #13476:
URL: https://github.com/apache/druid/pull/13476#discussion_r1068264056
##########
indexing-service/src/main/java/org/apache/druid/indexing/worker/WorkerTaskManager.java:
##########
@@ -329,14 +341,29 @@
}
}
- public File getAssignedTaskDir()
+ public File getAssignedTaskFile(String taskId)
{
- return new File(taskConfig.getBaseTaskDir(), "assignedTasks");
+ return new File(new File(taskConfig.getBaseTaskDir(taskId), ASSIGNED),
taskId);
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/3658)
##########
indexing-service/src/main/java/org/apache/druid/indexing/common/config/TaskConfig.java:
##########
@@ -300,4 +338,50 @@
return configParameter;
}
+
+ private static class TaskStorageDirTracker
+ {
+ private int taskDirIndex = 0;
+
+ private final List<File> baseTaskDirs = new ArrayList<>();
+
+ private final Map<String, File> taskToTempDirMap = new HashMap<>();
+
+ TaskStorageDirTracker(final List<String> baseTaskDirPaths)
+ {
+ for (String baseTaskDirPath : baseTaskDirPaths) {
+ baseTaskDirs.add(new File(baseTaskDirPath));
+ }
+ }
+
+ List<File> getBaseTaskDirs()
+ {
+ return baseTaskDirs;
+ }
+
+ synchronized File getOrSelectTaskDir(final String taskId)
+ {
+ if (!taskToTempDirMap.containsKey(taskId)) {
+ addTask(taskId, baseTaskDirs.get(taskDirIndex));
+ taskDirIndex = (taskDirIndex + 1) % baseTaskDirs.size();
Review Comment:
## User-controlled data in arithmetic expression
This arithmetic expression depends on a [user-provided value](1),
potentially causing an overflow.
[Show more
details](https://github.com/apache/druid/security/code-scanning/3660)
##########
indexing-service/src/main/java/org/apache/druid/indexing/worker/WorkerTaskManager.java:
##########
@@ -430,9 +457,17 @@
}
}
- public File getCompletedTaskDir()
+ public List<File> getCompletedTaskDirs()
+ {
+ return taskConfig.getBaseTaskDirs()
+ .stream()
+ .map(location -> new File(location.getPath(), COMPLETED))
+ .collect(Collectors.toList());
+ }
+
+ public File getCompletedTaskFile(String taskId)
{
- return new File(taskConfig.getBaseTaskDir(), "completedTasks");
+ return new File(new File(taskConfig.getBaseTaskDir(taskId), COMPLETED),
taskId);
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/3659)
##########
indexing-service/src/main/java/org/apache/druid/indexing/common/config/TaskConfig.java:
##########
@@ -190,15 +207,31 @@
return baseDir;
}
+ @JsonProperty("baseTaskDir")
+ public String getBaseTaskDirPath()
+ {
+ return baseTaskDirPath;
+ }
+
@JsonProperty
- public File getBaseTaskDir()
+ public List<String> getBaseTaskDirPaths()
{
- return baseTaskDir;
+ return baseTaskDirPaths;
+ }
+
+ public List<File> getBaseTaskDirs()
+ {
+ return tracker.getBaseTaskDirs();
+ }
+
+ public File getBaseTaskDir(String taskId)
+ {
+ return tracker.getOrSelectTaskDir(taskId);
}
public File getTaskDir(String taskId)
{
- return new File(baseTaskDir, IdUtils.validateId("task ID", taskId));
+ return new File(getBaseTaskDir(taskId), taskId);
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/3657)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
