You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by st...@apache.org on 2018/10/17 05:37:46 UTC
hbase git commit: HBASE-21275 - Thrift Server (branch 1 fix) ->
Disable TRACE HTTP method for thrift http server (branch 1 only)
Repository: hbase
Updated Branches:
refs/heads/branch-1 0128fed9d -> b2705cc6b
HBASE-21275 - Thrift Server (branch 1 fix) -> Disable TRACE HTTP method for thrift http server (branch 1 only)
Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/b2705cc6
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/b2705cc6
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/b2705cc6
Branch: refs/heads/branch-1
Commit: b2705cc6b39963da3ccb8e20ae8ba2cd6f39a315
Parents: 0128fed
Author: Wellington Chevreuil <we...@ChevreuilWellington-MBP15.local>
Authored: Mon Oct 15 12:35:20 2018 +0100
Committer: Michael Stack <st...@apache.org>
Committed: Tue Oct 16 22:35:18 2018 -0700
----------------------------------------------------------------------
.../hadoop/hbase/thrift/ThriftServerRunner.java | 4 +-
.../hbase/thrift/TestThriftHttpServer.java | 70 ++++++++++++++++----
2 files changed, 59 insertions(+), 15 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hbase/blob/b2705cc6/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
----------------------------------------------------------------------
diff --git a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
index 71186d5..bfcaf7d 100644
--- a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
+++ b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
@@ -129,6 +129,7 @@ import org.mortbay.jetty.Server;
import org.mortbay.jetty.nio.SelectChannelConnector;
import org.mortbay.jetty.servlet.Context;
import org.mortbay.jetty.servlet.ServletHolder;
+import org.mortbay.jetty.webapp.WebAppContext;
import org.mortbay.thread.QueuedThreadPool;
import com.google.common.base.Joiner;
@@ -421,8 +422,9 @@ public class ThriftServerRunner implements Runnable {
httpServer = new Server();
// Context handler
- Context context = new Context(httpServer, "/", Context.SESSIONS);
+ Context context = new WebAppContext();
context.setContextPath("/");
+ context.setResourceBase("hbase-webapps/");
String httpPath = "/*";
httpServer.setHandler(context);
context.addServlet(new ServletHolder(thriftHttpServlet), httpPath);
http://git-wip-us.apache.org/repos/asf/hbase/blob/b2705cc6/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
----------------------------------------------------------------------
diff --git a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
index ed91a29..c5b305d 100644
--- a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
+++ b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
@@ -18,6 +18,7 @@
*/
package org.apache.hadoop.hbase.thrift;
+import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertNull;
import static org.junit.Assert.fail;
@@ -152,6 +153,46 @@ public class TestThriftHttpServer {
runThriftServer(0);
}
+ @Test
+ public void testThriftServerHttpTraceForbiddenWhenOptionsDisabled() throws Exception {
+ // HTTP TRACE method should be disabled for security
+ // See https://www.owasp.org/index.php/Cross_Site_Tracing
+ checkHttpMethods("TRACE", HttpURLConnection.HTTP_FORBIDDEN);
+ }
+
+ @Test
+ public void testThriftServerHttpTraceForbiddenWhenOptionsEnabled() throws Exception {
+ // HTTP TRACE method should be disabled for security
+ // See https://www.owasp.org/index.php/Cross_Site_Tracing
+ TEST_UTIL.getConfiguration().setBoolean(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD,
+ true);
+ checkHttpMethods("TRACE", HttpURLConnection.HTTP_FORBIDDEN);
+ }
+
+ @Test
+ public void testThriftServerHttpOptionsForbiddenWhenOptionsDisabled() throws Exception {
+ // HTTP OPTIONS method should be disabled by default, so we make sure
+ // hbase.thrift.http.allow.options.method is not set anywhere in the config
+ TEST_UTIL.getConfiguration().unset(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD);
+ checkHttpMethods("OPTIONS", HttpURLConnection.HTTP_FORBIDDEN);
+ }
+
+ @Test
+ public void testThriftServerHttpOptionsOkWhenOptionsEnabled() throws Exception {
+ TEST_UTIL.getConfiguration().setBoolean(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD,
+ true);
+ checkHttpMethods("OPTIONS", HttpURLConnection.HTTP_OK);
+ }
+
+ private void waitThriftServerStartup() throws Exception{
+ // wait up to 10s for the server to start
+ for (int i = 0; i < 100
+ && ( thriftServer.serverRunner == null || thriftServer.serverRunner.httpServer ==
+ null); i++) {
+ Thread.sleep(100);
+ }
+ }
+
private void runThriftServer(int customHeaderSize) throws Exception {
List<String> args = new ArrayList<String>();
port = HBaseTestingUtility.randomFreePort();
@@ -162,16 +203,10 @@ public class TestThriftHttpServer {
thriftServer = new ThriftServer(TEST_UTIL.getConfiguration());
startHttpServerThread(args.toArray(new String[args.size()]));
- // wait up to 10s for the server to start
- for (int i = 0; i < 100
- && ( thriftServer.serverRunner == null || thriftServer.serverRunner.httpServer ==
- null); i++) {
- Thread.sleep(100);
- }
+ waitThriftServerStartup();
String url = "http://"+ HConstants.LOCALHOST + ":" + port;
try {
- checkHttpMethods(url);
talkToThriftServer(url, customHeaderSize);
} catch (Exception ex) {
clientSideException = ex;
@@ -189,13 +224,20 @@ public class TestThriftHttpServer {
}
}
- private void checkHttpMethods(String url) throws Exception {
- // HTTP TRACE method should be disabled for security
- // See https://www.owasp.org/index.php/Cross_Site_Tracing
- HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection();
- conn.setRequestMethod("TRACE");
- conn.connect();
- Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
+ private void checkHttpMethods(String httpRequestMethod,
+ int httpExpectedResponse) throws Exception {
+ port = HBaseTestingUtility.randomFreePort();
+ thriftServer = new ThriftServer(TEST_UTIL.getConfiguration());
+ try {
+ startHttpServerThread(new String[] { "-port", String.valueOf(port), "start" });
+ waitThriftServerStartup();
+ final URL url = new URL("http://"+ HConstants.LOCALHOST + ":" + port);
+ final HttpURLConnection httpConn = (HttpURLConnection) url.openConnection();
+ httpConn.setRequestMethod(httpRequestMethod);
+ assertEquals(httpExpectedResponse, httpConn.getResponseCode());
+ } finally {
+ stopHttpServerThread();
+ }
}
private static volatile boolean tableCreated = false;