[
https://issues.apache.org/jira/browse/HADOOP-19079?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17817945#comment-17817945
]
ASF GitHub Bot commented on HADOOP-19079:
-----------------------------------------
steveloughran commented on code in PR #6557:
URL: https://github.com/apache/hadoop/pull/6557#discussion_r1492391543
##########
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/util/TestHttpExceptionUtils.java:
##########
@@ -164,4 +164,30 @@ public void testValidateResponseJsonErrorUnknownException()
}
}
+ @Test
+ public void testValidateResponseJsonErrorNonException() throws IOException {
+ Map<String, Object> json = new HashMap<String, Object>();
+ json.put(HttpExceptionUtils.ERROR_EXCEPTION_JSON, "invalid");
+ // test case where the exception classname is not a valid exception class
+ json.put(HttpExceptionUtils.ERROR_CLASSNAME_JSON, String.class.getName());
+ json.put(HttpExceptionUtils.ERROR_MESSAGE_JSON, "EX");
+ Map<String, Object> response = new HashMap<String, Object>();
+ response.put(HttpExceptionUtils.ERROR_JSON, json);
+ ObjectMapper jsonMapper = new ObjectMapper();
+ String msg = jsonMapper.writeValueAsString(response);
+ InputStream is = new ByteArrayInputStream(msg.getBytes());
+ HttpURLConnection conn = Mockito.mock(HttpURLConnection.class);
+ Mockito.when(conn.getErrorStream()).thenReturn(is);
+ Mockito.when(conn.getResponseMessage()).thenReturn("msg");
+ Mockito.when(conn.getResponseCode()).thenReturn(
+ HttpURLConnection.HTTP_BAD_REQUEST);
+ try {
+ HttpExceptionUtils.validateResponse(conn,
HttpURLConnection.HTTP_CREATED);
Review Comment:
use `LambdaTestUtils.intercept()`, which is based off ScalaTest's version,
includes test for error message text.
```java
intercept(IOException.class,
"HTTP status [400], exception [java.lang.String], message [EX], URL
[null]",
() -> HttpExceptionUtils.validateResponse(conn,
HttpURLConnection.HTTP_CREATED);
```
```
> check that class that is loaded is really an exception
> ------------------------------------------------------
>
> Key: HADOOP-19079
> URL: https://issues.apache.org/jira/browse/HADOOP-19079
> Project: Hadoop Common
> Issue Type: Task
> Components: common, security
> Reporter: PJ Fanning
> Priority: Major
> Labels: pull-request-available
>
> It can be dangerous taking class names as inputs from HTTP messages even if
> we control the source. Issue is in HttpExceptionUtils in hadoop-common
> (validateResponse method).
> I can provide a PR that will highlight the issue.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
