[
https://issues.apache.org/jira/browse/IMPALA-15219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110147#comment-18110147
]
ASF subversion and git services commented on IMPALA-15219:
----------------------------------------------------------
Commit 9e92b6f80f44b273967ed991f68f77bf417aa6af in impala's branch
refs/heads/branch-4.5.2 from yida.wu
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=9e92b6f80 ]
IMPALA-15219: Enforce strict validation for AI endpoint hostnames
The AiFunctions currently validates allowed AI endpoints using
a simple substring match (gstrncasestr). This can allow
improperly formatted or malicious URLs to pass validation if
they contain the target domain string in the path.
This commit makes the validation stricter and more robust by
enforcing structural hostname matching:
1. Added a helper ExtractHost() to parse the URL and isolate
the canonical hostname.
2. Added a helper IsHostMatch() to perform exact domain and
strict subdomain matching against the allowed endpoint list.
3. Updated GetAiPlatformFromEndpoint() to evaluate the exact
host using the new helper functions, ensuring malicious URLs
are rejected as unsupported.
Testing:
Added test cases to AiFunctionsTest and
AiFunctionsTestAdditionalSites to ensure that URLs with
target domains hidden in paths are correctly rejected.
Change-Id: I5481dec7d798dc6ca7273b0028b9317ab69c39f5
Reviewed-on: http://gerrit.cloudera.org:8080/24775
Reviewed-by: Joe McDonnell <[email protected]>
Tested-by: Michael Smith <[email protected]>
> Test 4
> ------
>
> Key: IMPALA-15219
> URL: https://issues.apache.org/jira/browse/IMPALA-15219
> Project: IMPALA
> Issue Type: Bug
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
