You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hive.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2020/06/16 16:25:00 UTC
[jira] [Work logged] (HIVE-23704) Thrift HTTP Server Does Not
Handle Auth Handle Correctly
[ https://issues.apache.org/jira/browse/HIVE-23704?focusedWorklogId=446623&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-446623 ]
ASF GitHub Bot logged work on HIVE-23704:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Jun/20 16:24
Start Date: 16/Jun/20 16:24
Worklog Time Spent: 10m
Work Description: belugabehr opened a new pull request #1127:
URL: https://github.com/apache/hive/pull/1127
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 446623)
Remaining Estimate: 0h
Time Spent: 10m
> Thrift HTTP Server Does Not Handle Auth Handle Correctly
> --------------------------------------------------------
>
> Key: HIVE-23704
> URL: https://issues.apache.org/jira/browse/HIVE-23704
> Project: Hive
> Issue Type: Bug
> Components: Security
> Affects Versions: 3.1.2, 2.3.7
> Reporter: David Mollitor
> Assignee: David Mollitor
> Priority: Critical
> Fix For: 4.0.0
>
> Attachments: Base64NegotiationError.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {code:java|title=ThriftHttpServlet.java}
> private String[] getAuthHeaderTokens(HttpServletRequest request,
> String authType) throws HttpAuthenticationException {
> String authHeaderBase64 = getAuthHeader(request, authType);
> String authHeaderString = StringUtils.newStringUtf8(
> Base64.decodeBase64(authHeaderBase64.getBytes()));
> String[] creds = authHeaderString.split(":");
> return creds;
> }
> {code}
> So here, it takes the authHeaderBase64 (which is a base-64 string), and converts it into bytes, and then it tries to decode those bytes. That is incorrect It should covert base-64 string directly into bytes.
> I tried to do this as part of [HIVE-22676] and the tests was failing because the string that is being decoded is not actually Base-64 (see attached image) It has a stray space and a colon. Again, the existing code doesn't care because it's not parsing Base-64 text, it is parsing the bytes generated by converting base-64 text to bytes.
> I'm not sure what affect this has, what security issues this may present, but it's definitely not correct.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)