abstractdog commented on code in PR #536:
URL: https://github.com/apache/tez/pull/536#discussion_r4060752521
##########
tez-plugins/tez-aux-services/src/main/java/org/apache/tez/auxservices/ShuffleHandler.java:
##########
@@ -1167,6 +1195,41 @@ private boolean isNullOrEmpty(List<String> entries) {
return entries == null || entries.isEmpty();
}
+ /**
+ * Validate the structural query parameters (dag, vertex, map/attempt) that
+ * are concatenated into filesystem paths, rejecting anything containing a
+ * path-traversal component so the request cannot escape the per-app
+ * shuffle directory. Returns true when the request may proceed and false
+ * when it has already been closed with a 400 response.
+ */
+ private boolean validateShufflePathParams(ChannelHandlerContext ctx,
+ List<String> dagIdQ, List<String> vertexIdQ, List<String> mapIds,
+ boolean isDeleteRequest) {
Review Comment:
ack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
