slfan1989 commented on code in PR #8701:
URL: https://github.com/apache/hadoop/pull/8701#discussion_r3888745603
##########
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/WebAppProxyServlet.java:
##########
@@ -265,6 +269,12 @@ private void proxyLink(final HttpServletRequest req,
// similar could cause issues otherwise.
InetAddress localAddress = InetAddress.getByName(proxyHost);
LOG.debug("local InetAddress for proxy host: {}", localAddress);
+ // The tracking URL is supplied by the application and is fetched
+ // server-side, so a malicious AM can return a redirect pointing at the
+ // cluster's internal services or the cloud metadata endpoint. Only follow
+ // redirects that stay on the application's own host.
+ httpClientBuilder.setRedirectStrategy(
Review Comment:
The `link` is derived from `ApplicationReport#getOriginalTrackingUrl()`,
which is controlled by the AM. `SameHostRedirectStrategy` is only invoked after
the initial response is a redirect, so a directly supplied unsafe tracking URL
reaches `HttpGet/HttpPut` without this check.
In addition, the allowed host is derived from the same untrusted URL, so it
does not establish an independent trust boundary. Please validate the initial
destination against an independently trusted policy or source before executing
the request, and add an end-to-end regression test for a directly supplied
target in addition to the redirect-strategy unit test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
