You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by sr...@apache.org on 2015/09/16 20:19:27 UTC
spark git commit: [SPARK-10589] [WEBUI] Add defense against external
site framing
Repository: spark
Updated Branches:
refs/heads/master d9b7f3e4d -> 5dbaf3d39
[SPARK-10589] [WEBUI] Add defense against external site framing
Set `X-Frame-Options: SAMEORIGIN` to protect against frame-related vulnerability
Author: Sean Owen <so...@cloudera.com>
Closes #8745 from srowen/SPARK-10589.
Project: http://git-wip-us.apache.org/repos/asf/spark/repo
Commit: http://git-wip-us.apache.org/repos/asf/spark/commit/5dbaf3d3
Tree: http://git-wip-us.apache.org/repos/asf/spark/tree/5dbaf3d3
Diff: http://git-wip-us.apache.org/repos/asf/spark/diff/5dbaf3d3
Branch: refs/heads/master
Commit: 5dbaf3d3911bbfa003bc75459aaad66b4f6e0c67
Parents: d9b7f3e
Author: Sean Owen <so...@cloudera.com>
Authored: Wed Sep 16 19:19:23 2015 +0100
Committer: Sean Owen <so...@cloudera.com>
Committed: Wed Sep 16 19:19:23 2015 +0100
----------------------------------------------------------------------
.../apache/spark/deploy/worker/ui/WorkerWebUI.scala | 7 ++++---
.../org/apache/spark/metrics/MetricsSystem.scala | 2 +-
.../apache/spark/metrics/sink/MetricsServlet.scala | 6 +++---
.../main/scala/org/apache/spark/ui/JettyUtils.scala | 16 ++++++++++++++--
core/src/main/scala/org/apache/spark/ui/WebUI.scala | 4 ++--
5 files changed, 24 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/spark/blob/5dbaf3d3/core/src/main/scala/org/apache/spark/deploy/worker/ui/WorkerWebUI.scala
----------------------------------------------------------------------
diff --git a/core/src/main/scala/org/apache/spark/deploy/worker/ui/WorkerWebUI.scala b/core/src/main/scala/org/apache/spark/deploy/worker/ui/WorkerWebUI.scala
index 709a272..1a0598e 100644
--- a/core/src/main/scala/org/apache/spark/deploy/worker/ui/WorkerWebUI.scala
+++ b/core/src/main/scala/org/apache/spark/deploy/worker/ui/WorkerWebUI.scala
@@ -20,9 +20,8 @@ package org.apache.spark.deploy.worker.ui
import java.io.File
import javax.servlet.http.HttpServletRequest
-import org.apache.spark.{Logging, SparkConf}
+import org.apache.spark.Logging
import org.apache.spark.deploy.worker.Worker
-import org.apache.spark.deploy.worker.ui.WorkerWebUI._
import org.apache.spark.ui.{SparkUI, WebUI}
import org.apache.spark.ui.JettyUtils._
import org.apache.spark.util.RpcUtils
@@ -49,7 +48,9 @@ class WorkerWebUI(
attachPage(new WorkerPage(this))
attachHandler(createStaticHandler(WorkerWebUI.STATIC_RESOURCE_BASE, "/static"))
attachHandler(createServletHandler("/log",
- (request: HttpServletRequest) => logPage.renderLog(request), worker.securityMgr))
+ (request: HttpServletRequest) => logPage.renderLog(request),
+ worker.securityMgr,
+ worker.conf))
}
}
http://git-wip-us.apache.org/repos/asf/spark/blob/5dbaf3d3/core/src/main/scala/org/apache/spark/metrics/MetricsSystem.scala
----------------------------------------------------------------------
diff --git a/core/src/main/scala/org/apache/spark/metrics/MetricsSystem.scala b/core/src/main/scala/org/apache/spark/metrics/MetricsSystem.scala
index 4517f46..48afe3a 100644
--- a/core/src/main/scala/org/apache/spark/metrics/MetricsSystem.scala
+++ b/core/src/main/scala/org/apache/spark/metrics/MetricsSystem.scala
@@ -88,7 +88,7 @@ private[spark] class MetricsSystem private (
*/
def getServletHandlers: Array[ServletContextHandler] = {
require(running, "Can only call getServletHandlers on a running MetricsSystem")
- metricsServlet.map(_.getHandlers).getOrElse(Array())
+ metricsServlet.map(_.getHandlers(conf)).getOrElse(Array())
}
metricsConfig.initialize()
http://git-wip-us.apache.org/repos/asf/spark/blob/5dbaf3d3/core/src/main/scala/org/apache/spark/metrics/sink/MetricsServlet.scala
----------------------------------------------------------------------
diff --git a/core/src/main/scala/org/apache/spark/metrics/sink/MetricsServlet.scala b/core/src/main/scala/org/apache/spark/metrics/sink/MetricsServlet.scala
index 0c2e212..4193e1d 100644
--- a/core/src/main/scala/org/apache/spark/metrics/sink/MetricsServlet.scala
+++ b/core/src/main/scala/org/apache/spark/metrics/sink/MetricsServlet.scala
@@ -27,7 +27,7 @@ import com.codahale.metrics.json.MetricsModule
import com.fasterxml.jackson.databind.ObjectMapper
import org.eclipse.jetty.servlet.ServletContextHandler
-import org.apache.spark.SecurityManager
+import org.apache.spark.{SparkConf, SecurityManager}
import org.apache.spark.ui.JettyUtils._
private[spark] class MetricsServlet(
@@ -49,10 +49,10 @@ private[spark] class MetricsServlet(
val mapper = new ObjectMapper().registerModule(
new MetricsModule(TimeUnit.SECONDS, TimeUnit.MILLISECONDS, servletShowSample))
- def getHandlers: Array[ServletContextHandler] = {
+ def getHandlers(conf: SparkConf): Array[ServletContextHandler] = {
Array[ServletContextHandler](
createServletHandler(servletPath,
- new ServletParams(request => getMetricsSnapshot(request), "text/json"), securityMgr)
+ new ServletParams(request => getMetricsSnapshot(request), "text/json"), securityMgr, conf)
)
}
http://git-wip-us.apache.org/repos/asf/spark/blob/5dbaf3d3/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
----------------------------------------------------------------------
diff --git a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
index 779c0ba..b796a44 100644
--- a/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
+++ b/core/src/main/scala/org/apache/spark/ui/JettyUtils.scala
@@ -59,7 +59,17 @@ private[spark] object JettyUtils extends Logging {
def createServlet[T <% AnyRef](
servletParams: ServletParams[T],
- securityMgr: SecurityManager): HttpServlet = {
+ securityMgr: SecurityManager,
+ conf: SparkConf): HttpServlet = {
+
+ // SPARK-10589 avoid frame-related click-jacking vulnerability, using X-Frame-Options
+ // (see http://tools.ietf.org/html/rfc7034). By default allow framing only from the
+ // same origin, but allow framing for a specific named URI.
+ // Example: spark.ui.allowFramingFrom = https://example.com/
+ val allowFramingFrom = conf.getOption("spark.ui.allowFramingFrom")
+ val xFrameOptionsValue =
+ allowFramingFrom.map(uri => s"ALLOW-FROM $uri").getOrElse("SAMEORIGIN")
+
new HttpServlet {
override def doGet(request: HttpServletRequest, response: HttpServletResponse) {
try {
@@ -68,6 +78,7 @@ private[spark] object JettyUtils extends Logging {
response.setStatus(HttpServletResponse.SC_OK)
val result = servletParams.responder(request)
response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate")
+ response.setHeader("X-Frame-Options", xFrameOptionsValue)
// scalastyle:off println
response.getWriter.println(servletParams.extractFn(result))
// scalastyle:on println
@@ -97,8 +108,9 @@ private[spark] object JettyUtils extends Logging {
path: String,
servletParams: ServletParams[T],
securityMgr: SecurityManager,
+ conf: SparkConf,
basePath: String = ""): ServletContextHandler = {
- createServletHandler(path, createServlet(servletParams, securityMgr), basePath)
+ createServletHandler(path, createServlet(servletParams, securityMgr, conf), basePath)
}
/** Create a context handler that responds to a request with the given path prefix */
http://git-wip-us.apache.org/repos/asf/spark/blob/5dbaf3d3/core/src/main/scala/org/apache/spark/ui/WebUI.scala
----------------------------------------------------------------------
diff --git a/core/src/main/scala/org/apache/spark/ui/WebUI.scala b/core/src/main/scala/org/apache/spark/ui/WebUI.scala
index 6144984..81a121f 100644
--- a/core/src/main/scala/org/apache/spark/ui/WebUI.scala
+++ b/core/src/main/scala/org/apache/spark/ui/WebUI.scala
@@ -76,9 +76,9 @@ private[spark] abstract class WebUI(
def attachPage(page: WebUIPage) {
val pagePath = "/" + page.prefix
val renderHandler = createServletHandler(pagePath,
- (request: HttpServletRequest) => page.render(request), securityManager, basePath)
+ (request: HttpServletRequest) => page.render(request), securityManager, conf, basePath)
val renderJsonHandler = createServletHandler(pagePath.stripSuffix("/") + "/json",
- (request: HttpServletRequest) => page.renderJson(request), securityManager, basePath)
+ (request: HttpServletRequest) => page.renderJson(request), securityManager, conf, basePath)
attachHandler(renderHandler)
attachHandler(renderJsonHandler)
pageToHandlers.getOrElseUpdate(page, ArrayBuffer[ServletContextHandler]())
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org