nishat-06 opened a new pull request, #8701: URL: https://github.com/apache/hadoop/pull/8701
### Description of PR `WebAppProxyServlet.proxyLink` fetches an application's tracking URL server-side with an HttpClient that auto-follows redirects, and that tracking URL is whatever the application master registered. A malicious AM can answer the proxied request with a redirect to `http://169.254.169.254/` (cloud metadata), a loopback admin port, or another internal cluster service, and the proxy follows it and streams the response back to the viewing user, which is a server-side request forgery. This restricts the follow to the application's own host: a `SameHostRedirectStrategy` rejects any redirect whose host differs from the tracking URL host, so a same-host application UI redirect still works while a cross-host hop is refused. Trigger before the change: AM registers a tracking URL, the proxied `GET` returns `302 Location: http://169.254.169.254/latest/meta-data/`, and the proxy fetches the metadata endpoint from inside the cluster and returns the body. After the change that redirect is not followed and the fetch fails like any other unreachable target. ### How was this patch tested? Added `testProxyRedirectToDifferentHostIsRefused` which drives the strategy with a same-host `Location` (followed) and a `169.254.169.254` `Location` (refused with `ProtocolException`), and ran the `hadoop-yarn-server-web-proxy` module tests. The `testAppReportForEmptyTrackingUrl` failure seen locally is unrelated and reproduces on a clean tree (this host has no resolvable hostname). ### For code changes: - [ ] Does the title of this PR start with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')? - [ ] Object storage: Have the integration tests been executed and the endpoint declared according to the connector-specific documentation? *Note: Automated CI testing doesn't cover all cases so manual testing with cloud storage is still required.* - [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)? - [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, `NOTICE-binary` files? ### AI Tooling If an AI tool was used: - [ ] The PR includes the phrase "Contains content generated by <tool>" where <tool> is the name of the AI tool used. - [ ] My use of AI contributions follows the ASF legal policy https://www.apache.org/legal/generative-tooling.html -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
