[
https://issues.apache.org/jira/browse/HADOOP-19079?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17828461#comment-17828461
]
ASF GitHub Bot commented on HADOOP-19079:
-----------------------------------------
steveloughran commented on code in PR #6557:
URL: https://github.com/apache/hadoop/pull/6557#discussion_r1530821435
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/HttpExceptionUtils.java:
##########
@@ -150,9 +156,14 @@ public static void validateResponse(HttpURLConnection conn,
try {
ClassLoader cl = HttpExceptionUtils.class.getClassLoader();
Class klass = cl.loadClass(exClass);
- Constructor constr = klass.getConstructor(String.class);
- toThrow = (Exception) constr.newInstance(exMsg);
- } catch (Exception ex) {
+ if (!Exception.class.isAssignableFrom(klass)) {
Review Comment:
use Preconditions.checkState() with error text including classname. if it
ever does happen, we will want to debug
##########
hadoop-common-project/hadoop-common/src/test/java/org/apache/hadoop/util/TestHttpExceptionUtils.java:
##########
@@ -164,4 +164,30 @@ public void testValidateResponseJsonErrorUnknownException()
}
}
+ @Test
+ public void testValidateResponseJsonErrorNonException() throws IOException {
+ Map<String, Object> json = new HashMap<String, Object>();
+ json.put(HttpExceptionUtils.ERROR_EXCEPTION_JSON, "invalid");
+ // test case where the exception classname is not a valid exception class
+ json.put(HttpExceptionUtils.ERROR_CLASSNAME_JSON, String.class.getName());
+ json.put(HttpExceptionUtils.ERROR_MESSAGE_JSON, "EX");
+ Map<String, Object> response = new HashMap<String, Object>();
+ response.put(HttpExceptionUtils.ERROR_JSON, json);
+ ObjectMapper jsonMapper = new ObjectMapper();
+ String msg = jsonMapper.writeValueAsString(response);
+ InputStream is = new ByteArrayInputStream(msg.getBytes());
+ HttpURLConnection conn = Mockito.mock(HttpURLConnection.class);
+ Mockito.when(conn.getErrorStream()).thenReturn(is);
+ Mockito.when(conn.getResponseMessage()).thenReturn("msg");
+ Mockito.when(conn.getResponseCode()).thenReturn(
+ HttpURLConnection.HTTP_BAD_REQUEST);
+ try {
+ HttpExceptionUtils.validateResponse(conn,
HttpURLConnection.HTTP_CREATED);
Review Comment:
old code, going near the test is the time to clean it up.
> check that class that is loaded is really an exception
> ------------------------------------------------------
>
> Key: HADOOP-19079
> URL: https://issues.apache.org/jira/browse/HADOOP-19079
> Project: Hadoop Common
> Issue Type: Task
> Components: common, security
> Reporter: PJ Fanning
> Priority: Major
> Labels: pull-request-available
>
> It can be dangerous taking class names as inputs from HTTP messages even if
> we control the source. Issue is in HttpExceptionUtils in hadoop-common
> (validateResponse method).
> I can provide a PR that will highlight the issue.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
