[
https://issues.apache.org/jira/browse/IMPALA-15219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113529#comment-18113529
]
ASF subversion and git services commented on IMPALA-15219:
----------------------------------------------------------
Commit 439fca3f7a651187e6cec6ec27d33f539fb9c23c in impala's branch
refs/heads/master from yida.wu
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=439fca3f7 ]
IMPALA-15219: Enforce strict validation for AI endpoint hostnames
The AiFunctions currently validates allowed AI endpoints using
a simple substring match (gstrncasestr). This can allow
improperly formatted or malicious URLs to pass validation if
they contain the target domain string in the path.
This commit makes the validation stricter and more robust by
enforcing structural hostname matching:
1. Added a helper ExtractHost() to parse the URL and isolate
the canonical hostname.
2. Added a helper IsHostMatch() to perform exact domain and
strict subdomain matching against the allowed endpoint list.
3. Updated GetAiPlatformFromEndpoint() to evaluate the exact
host using the new helper functions, ensuring malicious URLs
are rejected as unsupported.
Testing:
Added test cases to AiFunctionsTest and
AiFunctionsTestAdditionalSites to ensure that URLs with
target domains hidden in paths are correctly rejected.
Change-Id: I5481dec7d798dc6ca7273b0028b9317ab69c39f5
Reviewed-on: http://gerrit.cloudera.org:8080/24797
Reviewed-by: Michael Smith <[email protected]>
Tested-by: Michael Smith <[email protected]>
> Secrets Exfiltration via SSRF
> -----------------------------
>
> Key: IMPALA-15219
> URL: https://issues.apache.org/jira/browse/IMPALA-15219
> Project: IMPALA
> Issue Type: Bug
> Components: Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 5.0.0, Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-57866
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
