You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "susheelgupta7 (via GitHub)" <gi...@apache.org> on 2026/01/23 06:52:04 UTC
[PR] YARN-11923: YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI… [hadoop]
susheelgupta7 opened a new pull request, #8206:
URL: https://github.com/apache/hadoop/pull/8206
… TRACE block
<!--
Thanks for sending a pull request!
1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/HADOOP/How+To+Contribute
2. Make sure your PR title starts with JIRA issue id, e.g., 'HADOOP-17799. Your PR title ...'.
-->
### Description of PR
### How was this patch tested?
### For code changes:
- [X] Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, `NOTICE-binary` files?
### AI Tooling
If an AI tool was used:
- [ ] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [ ] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11923: YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI… [hadoop]
Posted by "susheelgupta7 (via GitHub)" <gi...@apache.org>.
susheelgupta7 commented on PR #8206:
URL: https://github.com/apache/hadoop/pull/8206#issuecomment-3810729471
@slfan1989 Could you help me with this infra issue ??
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8206/5/
```
ERROR: Checkout failed
Also: hudson.remoting.Channel$CallSiteStackTrace: Remote call to hadoop16
at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1923)
at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:384)
at hudson.remoting.Channel.call(Channel.java:1112)
at hudson.FilePath.act(FilePath.java:1228)
at hudson.FilePath.act(FilePath.java:1217)
at hudson.FilePath.mkdirs(FilePath.java:1408)
at PluginClassLoader for git//hudson.plugins.git.GitSCM.createClient(GitSCM.java:843)
at PluginClassLoader for git//hudson.plugins.git.GitSCM._checkout(GitSCM.java:1299)
at PluginClassLoader for git//hudson.plugins.git.GitSCM.checkout(GitSCM.java:1277)
at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:136)
at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:101)
at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:88)
at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11923: YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI… [hadoop]
Posted by "K0K0V0K (via GitHub)" <gi...@apache.org>.
K0K0V0K commented on PR #8206:
URL: https://github.com/apache/hadoop/pull/8206#issuecomment-3788806501
Thanks @susheelgupta7 for this security upgrade.
I think that if we hardcode these two HTTP methods, it will also affect non-Spark applications and could potentially break some custom YARN applications. For example, what if there is a specific YARN AM that has business logic tied to these trace calls?
What do you think about creating a new configuration list of allowed HTTP methods instead of hardcoding these values? If the list is empty, everything would behave as it does currently; otherwise, the methods would be filtered against the list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org
Re: [PR] YARN-11923: YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI… [hadoop]
Posted by "susheelgupta7 (via GitHub)" <gi...@apache.org>.
susheelgupta7 commented on PR #8206:
URL: https://github.com/apache/hadoop/pull/8206#issuecomment-3789616530
> Thanks @susheelgupta7 for this security upgrade.
>
> I think that if we hardcode these two HTTP methods, it will also affect non-Spark applications and could potentially break some custom YARN applications. For example, what if there is a specific YARN AM that has business logic tied to these trace calls?
>
> What do you think about creating a new configuration list of allowed HTTP methods instead of hardcoding these values? If the list is empty, everything would behave as it does currently; otherwise, the methods would be filtered against the list.
Thanks @K0K0V0K for the review. The custom YARN applications may be impacted. I'll update the implementation to use a configurable approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org