[
https://issues.apache.org/jira/browse/MAPREDUCE-2858?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13128712#comment-13128712
]
Luke Lu commented on MAPREDUCE-2858:
------------------------------------
bq. The number of ways to get JavaScript running, or to embed external content
inside HTML content is amazing. Properly sandboxing untrusted content inside a
page without resorting to IFRAMEs is practically research territory. Writing
our own implementation of this is totally crazy. If we go that route, we should
use something like Google's Caja framework.
This comment is a misunderstanding of the current proposal. We're not trying to
reinvent Caja at all. In fact, I personally don't trust the approach of Caja.
It's too complex/slow and an overkill for our purpose. The only reason to
rewrite the urls in html is for non-transparent proxy. If we deploy transparent
proxy (which can be implemented straightforwardly via the full requestURI from
the GET header) via layer 4+ switches, no rewrite is needed. This is orthogonal
to the js whitelisting feature of the scanner. To give you an extreme example,
it's completely acceptable for the scanner to always return true for the
"maybeUnsafe" method. The whitelisting feature is a simple/safe/fast way to
improve user experience for admins and other users who are not the owners of
the target webapps, which is ultimately a nice thing to have but not absolutely
required for the proxy to achieve its purpose.
> MRv2 WebApp Security
> --------------------
>
> Key: MAPREDUCE-2858
> URL: https://issues.apache.org/jira/browse/MAPREDUCE-2858
> Project: Hadoop Map/Reduce
> Issue Type: Sub-task
> Components: applicationmaster, mrv2, security
> Affects Versions: 0.23.0
> Reporter: Luke Lu
> Assignee: Luke Lu
> Priority: Blocker
> Fix For: 0.23.0
>
>
> In MRv2, while the system servers (ResourceManager (RM), NodeManager (NM) and
> NameNode (NN)) run as "trusted"
> system users, the application masters (AM) run as users who submit the
> application. While this offers great flexibility
> to run multiple version of mapreduce frameworks (including their UI) on the
> same Hadoop cluster, it has significant
> implication for the security of webapps (Please do not discuss company
> specific vulnerabilities here).
> Requirements:
> # Secure authentication for AM (for app/job level ACLs).
> # Webapp security should be optional via site configuration.
> # Support existing pluggable single sign on mechanisms.
> # Should not require per app/user configuration for deployment.
> # Should not require special site-wide DNS configuration for deployment.
> This the top jira for webapp security. A design doc/notes of threat-modeling
> and counter measures will be posted on the wiki.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
