Hyukjin Kwon created SPARK-61205:
------------------------------------
Summary: Use TLS for a token on any host other than localhost,
also 127.0.0.1 and [::1], as PySpark does
Key: SPARK-61205
URL: https://issues.apache.org/jira/browse/SPARK-61205
Project: Spark
Issue Type: Bug
Components: Connect
Affects Versions: connect-rust-4.3.0
Reporter: Hyukjin Kwon
A token in a connection string to 127.0.0.1 or [::1] (for example through an
SSH tunnel to a TLS endpoint) made the Rust client dial plaintext, and the
token went in cleartext. PySpark uses TLS for every host except the literal
localhost (core.py toChannel), so the token went over TLS there.
Repro: `sc://127.0.0.1:443/;token=T` opens an http:// channel in the client,
where PySpark opens a TLS channel. The plaintext exception is now only host ==
"localhost".
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
