You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hbase.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/06/29 08:58:00 UTC

[jira] [Updated] (HBASE-30264) Validate bulkToken path in SecureBulkLoadManager.cleanupBulkLoad

     [ https://issues.apache.org/jira/browse/HBASE-30264?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated HBASE-30264:
-----------------------------------
    Labels: pull-request-available  (was: )

> Validate bulkToken path in SecureBulkLoadManager.cleanupBulkLoad
> ----------------------------------------------------------------
>
>                 Key: HBASE-30264
>                 URL: https://issues.apache.org/jira/browse/HBASE-30264
>             Project: HBase
>          Issue Type: Task
>          Components: regionserver
>            Reporter: Nick Dimiduk
>            Assignee: Nick Dimiduk
>            Priority: Major
>              Labels: pull-request-available
>
> The cleanupBulkLoad method in SecureBulkLoadManager constructs a Path directly from the bulkToken field of the CleanupBulkLoadRequest and passes it to fs.delete(path, true). The bulkToken is expected to be a staging directory created by prepareBulkLoad, which always places it under {hbase.rootdir}/staging/. However, cleanupBulkLoad does not verify that the supplied path is actually within the staging directory.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)