[
https://issues.apache.org/jira/browse/SENTRY-2068?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16261607#comment-16261607
]
Hadoop QA commented on SENTRY-2068:
-----------------------------------
Here are the results of testing the latest attachment
https://issues.apache.org/jira/secure/attachment/12898721/SENTRY-2068.1.patch
against master.
{color:green}Overall:{color} +1 all checks pass
{color:green}SUCCESS:{color} all tests passed
Console output:
https://builds.apache.org/job/PreCommit-SENTRY-Build/3509/console
This message is automatically generated.
> Disable HTTP TRACE method from the Sentry Web Server
> ----------------------------------------------------
>
> Key: SENTRY-2068
> URL: https://issues.apache.org/jira/browse/SENTRY-2068
> Project: Sentry
> Issue Type: Bug
> Components: Sentry
> Affects Versions: 1.8.0
> Reporter: Sergio Peña
> Assignee: Sergio Peña
> Attachments: SENTRY-2068.1.patch
>
>
> The HTTP TRACE method is normally used to return the full HTTP request back
> to the requesting client for proxy-debugging purposes. An attacker can create
> a webpage using XMLHTTP, ActiveX, or XMLDOM to cause a client to issue a
> TRACE request and capture the client's cookies. This effectively results in a
> Cross-Site Scripting attack.
> We should disable the HTTP TRACE method from the Web Server.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
