abstractdog commented on code in PR #537:
URL: https://github.com/apache/tez/pull/537#discussion_r4061547960
##########
tez-common/src/main/java/org/apache/tez/dag/utils/RelocalizationUtils.java:
##########
@@ -60,11 +60,37 @@ public static void addUrlsToClassPath(List<URL> urls) {
private static Path downloadResource(String destName, URI uri, Configuration
conf, String destDir)
throws IOException {
+ // destName is the map key from the client-supplied additionalAmResources
+ // and ends up as the file name we write under the AM working directory.
+ // Refuse anything that could redirect that write outside destDir — an
+ // absolute path, a path separator, or a ".." segment — so a submitter
+ // holding AM modify access cannot land a jar anywhere on the AM host and
+ // chain it into code execution via the classloader / am-hooks path.
+ validateDestName(destName);
Review Comment:
ack, handling with an upfront check
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
