[
https://issues.apache.org/jira/browse/YARN-5076?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15291461#comment-15291461
]
Junping Du commented on YARN-5076:
----------------------------------
The unit test failure is not related and we have other JIRA to track this.
However, we need to fix the checkstyle issue, especially the "missing
package-info.java file": I think it could be better to move the test class from
".../src/test/java/org/apache/hadoop/yarn/webapp/" to
".../src/test/java/org/apache/hadoop/yarn/server/resourcemanager/webapp/" given
we don't test other daemon's webapp.
> YARN web interfaces lack XFS protection
> ---------------------------------------
>
> Key: YARN-5076
> URL: https://issues.apache.org/jira/browse/YARN-5076
> Project: Hadoop YARN
> Issue Type: Bug
> Components: nodemanager, resourcemanager, timelineserver
> Reporter: Jonathan Maron
> Assignee: Jonathan Maron
> Attachments: YARN-5076.002.patch, YARN-5076.003.patch,
> YARN-5076.004.patch
>
> Original Estimate: 48h
> Remaining Estimate: 48h
>
> There are web interfaces in YARN that do not provide protection against cross
> frame scripting
> (https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet).
> HADOOP-13008 provides a common filter for addressing this vulnerability, so
> this filter should be integrated into the YARN web interfaces.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
