liyang created KYLIN-6120:
-----------------------------
Summary: Potential command execution issue in streaming job
termination
Key: KYLIN-6120
URL: https://issues.apache.org/jira/browse/KYLIN-6120
Project: Kylin
Issue Type: Bug
Components: NRT Streaming
Affects Versions: 5.0.5
Reporter: Yangliang Li
Assignee: liyang
Fix For: 5.0.6
Streaming job identifiers supplied through the model API are not validated
before they are used to construct a process lookup command during forced
termination. A user with ordinary project roles can potentially execute
operating-system commands with the Kylin service account.
Fix direction: avoid invoking a shell for process discovery and termination;
pass validated identifiers as individual arguments and reject non-canonical
model UUIDs at the API boundary.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
