github-code-scanning[bot] commented on code in PR #14063:
URL: https://github.com/apache/druid/pull/14063#discussion_r1163643277
##########
indexing-service/src/main/java/org/apache/druid/indexing/worker/WorkerTaskManager.java:
##########
@@ -284,8 +286,8 @@
try {
FileUtils.writeAtomically(
- getAssignedTaskFile(task.getId()),
- getTmpTaskDir(task.getId()),
+ new File(getAssignedTaskDir(), task.getId()),
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/36)
##########
indexing-service/src/main/java/org/apache/druid/indexing/worker/WorkerTaskManager.java:
##########
@@ -401,7 +381,7 @@
private void cleanupAssignedTask(Task task)
{
assignedTasks.remove(task.getId());
- File taskFile = getAssignedTaskFile(task.getId());
+ File taskFile = new File(getAssignedTaskDir(), task.getId());
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/37)
##########
indexing-service/src/main/java/org/apache/druid/indexing/worker/WorkerTaskManager.java:
##########
@@ -478,7 +450,7 @@
try {
FileUtils.writeAtomically(
- getCompletedTaskFile(taskId), getTmpTaskDir(taskId),
+ new File(getCompletedTaskDir(), taskId), getTmpTaskDir(),
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/38)
##########
indexing-service/src/main/java/org/apache/druid/indexing/overlord/ThreadingTaskRunner.java:
##########
@@ -155,8 +156,21 @@
@Override
public TaskStatus call()
{
+ final File baseDirForTask;
+ try {
+ baseDirForTask =
getTracker().pickBaseDir(task.getId());
+ }
+ catch (IOException e) {
+ LOG.error(e, "Failed to get directory for task
[%s], cannot schedule.", task.getId());
+ return TaskStatus.failure(
+ task.getId(),
+ StringUtils.format("Could not schedule due to
error [%s]", e.getMessage())
+ );
+
+ }
+ final File taskDir = new File(baseDirForTask,
task.getId());
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/4780)
##########
indexing-service/src/main/java/org/apache/druid/indexing/common/TaskStorageDirTracker.java:
##########
@@ -19,81 +19,67 @@
package org.apache.druid.indexing.common;
-import com.google.common.annotations.VisibleForTesting;
+import com.google.common.collect.ImmutableList;
import org.apache.druid.indexing.common.config.TaskConfig;
-import org.apache.druid.java.util.common.ISE;
+import org.apache.druid.indexing.worker.config.WorkerConfig;
-import javax.inject.Inject;
import java.io.File;
-import java.util.ArrayList;
-import java.util.HashMap;
+import java.io.IOException;
+import java.nio.file.Files;
import java.util.List;
-import java.util.Map;
+import java.util.stream.Collectors;
public class TaskStorageDirTracker
{
- private int taskDirIndex = 0;
-
- private final List<File> baseTaskDirs = new ArrayList<>();
-
- private final Map<String, File> taskToTempDirMap = new HashMap<>();
-
- @Inject
- public TaskStorageDirTracker(final TaskConfig taskConfig)
- {
- this(taskConfig.getBaseTaskDirPaths());
- }
-
- @VisibleForTesting
- public TaskStorageDirTracker(final List<String> baseTaskDirPaths)
+ public static TaskStorageDirTracker fromConfigs(WorkerConfig workerConfig,
TaskConfig taskConfig)
{
- for (String baseTaskDirPath : baseTaskDirPaths) {
- baseTaskDirs.add(new File(baseTaskDirPath));
+ if (workerConfig == null) {
+ return new
TaskStorageDirTracker(ImmutableList.of(taskConfig.getBaseTaskDir()));
+ } else {
+ final List<String> basePaths = workerConfig.getBaseTaskDirs();
+ if (basePaths == null) {
+ return new
TaskStorageDirTracker(ImmutableList.of(taskConfig.getBaseTaskDir()));
+ }
+ return new TaskStorageDirTracker(
+ basePaths.stream().map(File::new).collect(Collectors.toList())
+ );
}
}
- public File getTaskDir(String taskId)
- {
- return new File(getBaseTaskDir(taskId), taskId);
- }
+ private final List<File> baseTaskDirs;
- public File getTaskWorkDir(String taskId)
+ public TaskStorageDirTracker(List<File> baseTaskDirs)
{
- return new File(getTaskDir(taskId), "work");
+ this.baseTaskDirs = baseTaskDirs;
}
- public File getTaskTempDir(String taskId)
+ public File pickBaseDir(String taskId) throws IOException
{
- return new File(getTaskDir(taskId), "temp");
- }
-
- public List<File> getBaseTaskDirs()
- {
- return baseTaskDirs;
- }
-
- public synchronized File getBaseTaskDir(final String taskId)
- {
- if (!taskToTempDirMap.containsKey(taskId)) {
- addTask(taskId, baseTaskDirs.get(taskDirIndex));
- taskDirIndex = (taskDirIndex + 1) % baseTaskDirs.size();
+ File leastUsed = null;
+ long numEntries = Long.MAX_VALUE;
+
+ for (File baseTaskDir : baseTaskDirs) {
+ if (new File(baseTaskDir, taskId).exists()) {
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/4778)
##########
indexing-service/src/main/java/org/apache/druid/indexing/overlord/ForkingTaskRunner.java:
##########
@@ -155,9 +155,20 @@
public TaskStatus call()
{
- final String attemptId =
String.valueOf(getNextAttemptID(dirTracker, task.getId()));
- final String baseTaskDir =
dirTracker.getBaseTaskDir(task.getId()).getAbsolutePath();
- final File taskDir = dirTracker.getTaskDir(task.getId());
+ final File baseDirForTask;
+ try {
+ baseDirForTask = getTracker().pickBaseDir(task.getId());
+ }
+ catch (IOException e) {
+ LOG.error(e, "Failed to get directory for task [%s],
cannot schedule.", task.getId());
+ return TaskStatus.failure(
+ task.getId(),
+ StringUtils.format("Could not schedule due to error
[%s]", e.getMessage())
+ );
+ }
+
+ final File taskDir = new File(baseDirForTask, task.getId());
Review Comment:
## Uncontrolled data used in path expression
This path depends on a [user-provided value](1).
[Show more
details](https://github.com/apache/druid/security/code-scanning/4779)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
