[
https://issues.apache.org/jira/browse/HIVE-22533?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ádám Szita updated HIVE-22533:
------------------------------
Status: Patch Available (was: Open)
> Fix possible LLAP daemon web UI vulnerabilities
> -----------------------------------------------
>
> Key: HIVE-22533
> URL: https://issues.apache.org/jira/browse/HIVE-22533
> Project: Hive
> Issue Type: Improvement
> Components: llap
> Reporter: Ádám Szita
> Assignee: Ádám Szita
> Priority: Major
> Attachments: HIVE-22533.0.patch
>
>
> Security tools that look for possible vulnerabilities find issues with LLAP
> daemon web UI:
> * *dir listing* for _images,css,js_ folders
> * *missing X-Frame-Options response header* in the response
> Similarly we should disable dir listing on HS2 web UI /static page too, as it
> is of no use anyway.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
