abstractdog commented on code in PR #512:
URL: https://github.com/apache/tez/pull/512#discussion_r3467371670
##########
tez-plugins/tez-aux-services/src/main/java/org/apache/tez/auxservices/ShuffleHandler.java:
##########
@@ -1053,6 +1053,30 @@ private void handleRequest(ChannelHandlerContext ctx,
HttpRequest request)
"\n dagId: " + dagIdQ +
"\n keepAlive: " + keepAliveParam);
}
+ // Authenticate delete requests before execution
+ boolean isDeleteRequest = notEmptyAndContains(dagCompletedQ, "delete")
+ || notEmptyAndContains(vertexCompletedQ, "delete")
+ || notEmptyAndContains(taskAttemptFailedQ, "delete");
+ if (isDeleteRequest) {
+ if (jobQ == null || jobQ.isEmpty()) {
+ sendError(ctx, "Missing job parameter for delete request",
BAD_REQUEST);
+ return;
+ }
+ final String deleteReqUri = request.getUri();
+ if (deleteReqUri == null) {
+ sendError(ctx, FORBIDDEN);
+ return;
+ }
Review Comment:
this check doesn't seem specific to deletion I supposed
I would check if this can proceed at all a few lines above
```
final Map<String, List<String>> q = new
QueryStringDecoder(request.getUri()).parameters();
```
but the safest is to check this early
##########
tez-plugins/tez-aux-services/src/main/java/org/apache/tez/auxservices/ShuffleHandler.java:
##########
@@ -1053,6 +1053,30 @@ private void handleRequest(ChannelHandlerContext ctx,
HttpRequest request)
"\n dagId: " + dagIdQ +
"\n keepAlive: " + keepAliveParam);
}
+ // Authenticate delete requests before execution
+ boolean isDeleteRequest = notEmptyAndContains(dagCompletedQ, "delete")
+ || notEmptyAndContains(vertexCompletedQ, "delete")
+ || notEmptyAndContains(taskAttemptFailedQ, "delete");
+ if (isDeleteRequest) {
+ if (jobQ == null || jobQ.isEmpty()) {
+ sendError(ctx, "Missing job parameter for delete request",
BAD_REQUEST);
+ return;
+ }
+ final String deleteReqUri = request.getUri();
+ if (deleteReqUri == null) {
+ sendError(ctx, FORBIDDEN);
+ return;
+ }
Review Comment:
this check doesn't seem specific to deletion I suppose
I would check if this can proceed at all a few lines above
```
final Map<String, List<String>> q = new
QueryStringDecoder(request.getUri()).parameters();
```
but the safest is to check this early
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
