[
https://issues.apache.org/jira/browse/STORM-269?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13982471#comment-13982471
]
ASF GitHub Bot commented on STORM-269:
--------------------------------------
Github user ptgoetz commented on a diff in the pull request:
https://github.com/apache/incubator-storm/pull/91#discussion_r12031392
--- Diff: storm-core/src/clj/backtype/storm/daemon/logviewer.clj ---
@@ -30,9 +30,10 @@
[clojure.string :as string])
(:gen-class))
-(defn tail-file [path tail]
+(defn tail-file [path tail root-dir]
(let [flen (.length (clojure.java.io/file path))
skip (- flen tail)]
+ (if (.startsWith path root-dir)
--- End diff --
@d2r I think we're okay with this patch. I tried a couple of things and it
looks like you can't override `root-dir` in the request since the
`conf-middleware` function associates it with the request, so it is ignored if
supplied as a request parameter.
I tried the following url:
```
http://supervisor:8000/log?file=hosts&log-root=/etc/
```
And nothing was returned. I got the following in `logviewer.log`:
```
2014-04-27 14:07:23 o.m.log [WARN] /log?file=hosts&log-root=/etc/
java.io.FileNotFoundException: /var/log/storm/hosts (No such file or
directory)
```
(Note that in this installation, storm is configured to log to
`/var/log/storm/`)
> Any readable file exposed via UI log viewer
> -------------------------------------------
>
> Key: STORM-269
> URL: https://issues.apache.org/jira/browse/STORM-269
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Affects Versions: 0.9.2-incubating
> Reporter: Jared Kuolt
> Assignee: P. Taylor Goetz
> Labels: security
>
> Note: This is actually version 0.9.0.1 but I couldn't choose that in the
> dropdown. I suspect that the problem still exists.
> I found that it's possible to access any readable file on the system via the
> UI worker log viewer. To reproduce, navigate to:
> http://<host:port>/log?file=../../../../../../../../etc/passwd
--
This message was sent by Atlassian JIRA
(v6.2#6252)
