This is an automated email from the ASF dual-hosted git repository.
casionone pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/linkis.git
The following commit(s) were added to refs/heads/master by this push:
new 974438c957 #AI COMMIT# [SECURITY] Enforce server-side session map
check in ignore-timeout fallback (#5458)
974438c957 is described below
commit 974438c957554ad025e4ac4af0f30bac91574c29
Author: aiceflower <[email protected]>
AuthorDate: Thu Jul 16 14:17:06 2026 +0800
#AI COMMIT# [SECURITY] Enforce server-side session map check in
ignore-timeout fallback (#5458)
- getLoginUserIgnoreTimeout: normal users now go through isTimeoutOrNot
(session map lookup)
- OTHER_SYSTEM_IGNORE_UM_USER remains exempt (internal RPC, not
browser-cookie-based)
- Add escape hatch:
linkis.security.ignore.timeout.require.session.map=false restores legacy
behavior
- Add CommonVars import for config toggle
---
.../apache/linkis/server/security/SSOUtils.scala | 32 ++++++++++++++++++++--
1 file changed, 30 insertions(+), 2 deletions(-)
diff --git
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/security/SSOUtils.scala
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/security/SSOUtils.scala
index 2a162cb9b6..8efba0a417 100644
---
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/security/SSOUtils.scala
+++
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/security/SSOUtils.scala
@@ -17,7 +17,7 @@
package org.apache.linkis.server.security
-import org.apache.linkis.common.conf.Configuration
+import org.apache.linkis.common.conf.{CommonVars, Configuration}
import org.apache.linkis.common.utils.{Logging, RSAUtils, Utils}
import org.apache.linkis.server.conf.{ServerConfiguration,
SessionHAConfiguration}
import org.apache.linkis.server.exception.{
@@ -184,10 +184,38 @@ object SSOUtils extends Logging {
throw new NonLoginException(s"You are not logged in, please login
first(您尚未登录，请先登录!)")
)
+ // CVE-2026-XXXX (vuln C): always verify the server-side session map, even
+ // in the ignore-timeout path. The only exception is
OTHER_SYSTEM_IGNORE_UM_USER
+ // (internal RPC identity), which carries its own header-based
authentication.
+ //
+ // Escape hatch for non-HA deployments where gateway and backend have
separate
+ // session maps: set linkis.security.ignore.timeout.require.session.map=false
+ // to restore the old behavior (skip session map check in fallback).
+ private val requireSessionMapInFallback: Boolean =
+ CommonVars("linkis.security.ignore.timeout.require.session.map",
"true").getValue.toBoolean
+
private[security] def getLoginUserIgnoreTimeout(
getUserTicketId: String => Option[String]
): Option[String] =
-
getUserTicketId(USER_TICKET_ID_STRING).map(getUserAndLoginTime).flatMap(_.map(_._1))
+ getUserTicketId(USER_TICKET_ID_STRING).flatMap { t =>
+ getUserAndLoginTime(t).flatMap {
+ case (user, _) if user == SecurityFilter.OTHER_SYSTEM_IGNORE_UM_USER =>
+ Some(user) // internal RPC — exempt from session map check
+ case (user, _) if !requireSessionMapInFallback =>
+ Some(user) // escape hatch: skip session map check (legacy behavior)
+ case (user, _) =>
+ try {
+ isTimeoutOrNot(t) // normal user — must be in server-side session
map
+ Some(user)
+ } catch {
+ case _: LoginExpireException =>
+ logger.warn(
+ "Ignore-timeout path rejected ticket: valid decryption " +
+ "but ticket not present in server-side session map")
+ None
+ }
+ }
+ }
def updateLastAccessTime(getCookies: => Array[Cookie]): Unit =
updateLastAccessTime(_ =>
Option(getCookies).flatMap(_.find(_.getName ==
USER_TICKET_ID_STRING).map(_.getValue))
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
