[jira] [Commented] (IMPALA-15219) Secrets Exfiltration via SSRF

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/IMPALA-15219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113529#comment-18113529 ] 

ASF subversion and git services commented on IMPALA-15219:
----------------------------------------------------------

Commit 439fca3f7a651187e6cec6ec27d33f539fb9c23c in impala's branch refs/heads/master from yida.wu
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=439fca3f7 ]

IMPALA-15219: Enforce strict validation for AI endpoint hostnames

The AiFunctions currently validates allowed AI endpoints using
a simple substring match (gstrncasestr). This can allow
improperly formatted or malicious URLs to pass validation if
they contain the target domain string in the path.

This commit makes the validation stricter and more robust by
enforcing structural hostname matching:
1. Added a helper ExtractHost() to parse the URL and isolate
the canonical hostname.
2. Added a helper IsHostMatch() to perform exact domain and
strict subdomain matching against the allowed endpoint list.
3. Updated GetAiPlatformFromEndpoint() to evaluate the exact
host using the new helper functions, ensuring malicious URLs
are rejected as unsupported.

Testing:
Added test cases to AiFunctionsTest and
AiFunctionsTestAdditionalSites to ensure that URLs with
target domains hidden in paths are correctly rejected.

Change-Id: I5481dec7d798dc6ca7273b0028b9317ab69c39f5
Reviewed-on: http://gerrit.cloudera.org:8080/24797
Reviewed-by: Michael Smith <mi...@cloudera.com>
Tested-by: Michael Smith <mi...@cloudera.com>


> Secrets Exfiltration via SSRF
> -----------------------------
>
>                 Key: IMPALA-15219
>                 URL: https://issues.apache.org/jira/browse/IMPALA-15219
>             Project: IMPALA
>          Issue Type: Bug
>          Components: Security
>            Reporter: Michael Smith
>            Assignee: Michael Smith
>            Priority: Major
>             Fix For: Impala 5.0.0, Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-57866



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org