abstractdog commented on code in PR #528:
URL: https://github.com/apache/tez/pull/528#discussion_r3620969680
##########
tez-dag/src/main/java/org/apache/tez/dag/app/web/AMWebController.java:
##########
@@ -135,24 +135,26 @@ static String encodeHeader(final String header) {
public void setCorsHeaders() {
final HttpServletResponse res = response();
- /*
- * ideally the Origin and other CORS headers should be checked and
response headers set only
- * if it matches the allowed origins. however rm does not forward these
headers.
- */
String historyUrlBase =
appContext.getAMConf().get(TezConfiguration.TEZ_HISTORY_URL_BASE, "");
- String origin = request().getHeader(ORIGIN);
- if(origin == null) {
+ String trustedOrigin = null;
+ if (!historyUrlBase.isEmpty()) {
try {
URL url = URI.create(historyUrlBase).toURL();
- origin = url.getProtocol() + "://" + url.getAuthority();
+ trustedOrigin = url.getProtocol() + "://" + url.getAuthority();
} catch (IllegalArgumentException | MalformedURLException e) {
LOG.debug("Invalid url set for tez history url base: {}",
historyUrlBase, e);
}
}
- if (origin != null) {
- origin = encodeHeader(origin);
- res.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+ String requestOrigin = request().getHeader(ORIGIN);
+
+ if (trustedOrigin != null) {
+ if (requestOrigin == null || requestOrigin.equals(trustedOrigin)) {
+ res.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN,
encodeHeader(trustedOrigin));
Review Comment:
make a code comment above this for "educational purposes" regarding why we
cannot reflect the request origin without checking the server's trusted origin,
as this is the core of this fix
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
