This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch branch-0.10 in repository https://gitbox.apache.org/repos/asf/tez.git
commit 9ef59b0116f3c79828d78f990a56378329eefb10 Author: Ayush Saxena <[email protected]> AuthorDate: Fri Oct 31 17:23:24 2025 +0530 TEZ-4659: Refactoring minor issues in profile output servlet (#439). (Ayush Saxena, reviewed by Laszlo Bodor) --- .../java/org/apache/tez/common/web/ProfileOutputServlet.java | 12 +++++++++++- tez-tests/src/test/java/org/apache/tez/test/TestAM.java | 10 ++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java b/tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java index 2fac77cdc..67b90151e 100644 --- a/tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java +++ b/tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java @@ -27,6 +27,7 @@ import java.io.File; import java.io.IOException; import java.io.PrintWriter; import java.nio.file.Files; +import java.nio.file.Path; import java.nio.file.Paths; /** @@ -41,7 +42,16 @@ public class ProfileOutputServlet extends DefaultServlet { writeMessage(response, "Run the profiler to be able to receive its output"); return; } - File outputFile = new File(ProfileServlet.OUTPUT_DIR, queriedFile); + Path outputDir = Paths.get(ProfileServlet.OUTPUT_DIR).toAbsolutePath().normalize(); + Path requestedPath = outputDir.resolve(queriedFile).normalize(); + + if (!requestedPath.startsWith(outputDir)) { + response.setStatus(HttpServletResponse.SC_FORBIDDEN); + writeMessage(response, "Access denied: Invalid Path"); + return; + } + File outputFile = requestedPath.toFile(); + if (!outputFile.exists()) { writeMessage(response, "Requested file does not exist: " + queriedFile); return; diff --git a/tez-tests/src/test/java/org/apache/tez/test/TestAM.java b/tez-tests/src/test/java/org/apache/tez/test/TestAM.java index a31fa7e8a..09ef838b8 100644 --- a/tez-tests/src/test/java/org/apache/tez/test/TestAM.java +++ b/tez-tests/src/test/java/org/apache/tez/test/TestAM.java @@ -17,6 +17,7 @@ */ package org.apache.tez.test; +import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertNotNull; import static org.junit.Assert.assertTrue; import java.io.File; @@ -24,6 +25,9 @@ import java.io.IOException; import java.net.HttpURLConnection; import java.net.URL; +import javax.servlet.http.HttpServletResponse; + +import org.apache.commons.io.IOUtils; import org.apache.hadoop.conf.Configuration; import org.apache.hadoop.conf.Configuration.IntegerRanges; import org.apache.hadoop.fs.FileSystem; @@ -131,6 +135,12 @@ public class TestAM { checkAddress(webUIAddress + "/prof", 202); checkAddress(webUIAddress + "/prof-output"); + HttpURLConnection connection = + (HttpURLConnection) new URL(webUIAddress + "/prof-output?file=../etc/web").openConnection(); + connection.connect(); + assertEquals(HttpServletResponse.SC_FORBIDDEN, connection.getResponseCode()); + assertTrue(new String(IOUtils.toByteArray(connection.getErrorStream())).contains("Access denied: Invalid Path")); + URL url = new URL(webUIAddress); IntegerRanges portRange = conf.getRange(TezConfiguration.TEZ_AM_WEBSERVICE_PORT_RANGE, TezConfiguration.TEZ_AM_WEBSERVICE_PORT_RANGE_DEFAULT);
