[
https://issues.apache.org/jira/browse/TEZ-4742?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
László Bodor updated TEZ-4742:
------------------------------
Fix Version/s: 1.0.0
> AMWebController CORS: only reflect Origin when it matches configured Tez UI
> base URL
> ------------------------------------------------------------------------------------
>
> Key: TEZ-4742
> URL: https://issues.apache.org/jira/browse/TEZ-4742
> Project: Apache Tez
> Issue Type: Improvement
> Reporter: László Bodor
> Assignee: Raghav Aggarwal
> Priority: Major
> Fix For: 1.0.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> https://github.com/apache/tez/blob/b9d8c0f37b3c3fdc17d2c007297b3b559bd468a4/tez-dag/src/main/java/org/apache/tez/dag/app/web/AMWebController.java#L138-L141
> {code}
> /*
> * ideally the Origin and other CORS headers should be checked and
> response headers set only
> * if it matches the allowed origins. however rm does not forward these
> headers.
> */
> {code}
> setCorsHeaders() accepted whatever origin the browser sent in the request
> Origin header and reflected it back into Access-Control-Allow-Origin without
> checking that it was one we intended to trust, while also enabling
> Access-Control-Allow-Credentials. The response headers weren't derived from a
> configured allow-list, so the browser was being told to trust an origin the
> server hadn't vetted — which is broader than we want given that the AM UI
> generally sits behind an authentication filter. A pre-existing comment on the
> method noted that the origin ought to be validated against allowed origins.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
