You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ambari.apache.org by GitBox <gi...@apache.org> on 2020/07/16 08:29:06 UTC
[GitHub] [ambari] sziszo opened a new pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
sziszo opened a new pull request #3208:
URL: https://github.com/apache/ambari/pull/3208
## What changes were proposed in this pull request?
If an API call responds with stack traces that are not managed it could reveal information useful to attackers. This information could then be used in further attacks. Providing debugging information as a result of operations that generate errors is considered a bad practice due to multiple reasons. For example, it may contain information on internal workings of the application such as relative paths of the point where the application is installed or how objects are referenced internally
When a runtime error occurs during request processing, server will display debugging information to the requestor. Ideally, such debug information be withheld from the requestor.
More on the security threat:
CWE-209: Information Exposure Through an Error Message
Improper Error Handling
I see the following error stack when I run an Ambari API call:
```
# curl -X GET -u admin:admin "http://<ambari-host>:8080/api/v1/security/userlist/q;%"
HTTP ERROR 500
Problem accessing /api/v1/security/userlist/q;%. Reason:
Server Error
Caused by:
org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
at org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:265)
at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:245)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:193)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
at org.apache.ambari.server.api.MethodOverrideFilter.doFilter(MethodOverrideFilter.java:73)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
at org.apache.ambari.server.api.AmbariPersistFilter.doFilter(AmbariPersistFilter.java:53)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
at org.apache.ambari.server.security.AbstractSecurityHeaderFilter.doFilter(AbstractSecurityHeaderFilter.java:130)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
at org.eclipse.jetty.servlets.GzipFilter.doFilter(GzipFilter.java:51)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1642)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:533)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1340)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1242)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:740)
at org.apache.ambari.server.controller.AmbariHandlerList.processHandlers(AmbariHandlerList.java:221)
at org.apache.ambari.server.controller.AmbariHandlerList.processHandlers(AmbariHandlerList.java:210)
at org.apache.ambari.server.controller.AmbariHandlerList.handle(AmbariHandlerList.java:140)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
at org.eclipse.jetty.server.Server.handle(Server.java:503)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:364)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:765)
at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:683)
at java.lang.Thread.run(Thread.java:745)
```
## How was this patch tested?
This patch was tested manually.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] sziszo commented on a change in pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
sziszo commented on a change in pull request #3208:
URL: https://github.com/apache/ambari/pull/3208#discussion_r464306813
##########
File path: ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariHandlerList.java
##########
@@ -251,6 +251,10 @@ private WebAppContext getHandler(ViewInstanceEntity viewInstanceDefinition)
webAppContext.addFilter(new FilterHolder(springSecurityFilter), "/*", AmbariServer.DISPATCHER_TYPES);
webAppContext.setAllowNullPathInfo(true);
+ if (webAppContext.getErrorHandler() != null) {
+ webAppContext.getErrorHandler().setShowStacks(false);
Review comment:
yeah sure, it makes sense to make it configurable. Let me check if we already have this type of property or if I need to create a new one.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] hapylestat commented on a change in pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
hapylestat commented on a change in pull request #3208:
URL: https://github.com/apache/ambari/pull/3208#discussion_r464291707
##########
File path: ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariHandlerList.java
##########
@@ -251,6 +251,10 @@ private WebAppContext getHandler(ViewInstanceEntity viewInstanceDefinition)
webAppContext.addFilter(new FilterHolder(springSecurityFilter), "/*", AmbariServer.DISPATCHER_TYPES);
webAppContext.setAllowNullPathInfo(true);
+ if (webAppContext.getErrorHandler() != null) {
+ webAppContext.getErrorHandler().setShowStacks(false);
Review comment:
can we make this configurable via introducing some debug property or add logging to ambari-server.log?
In most cases, such kind of errors r not present in the logs and the only source of them r response from the server
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] sziszo commented on pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
sziszo commented on pull request #3208:
URL: https://github.com/apache/ambari/pull/3208#issuecomment-667902138
@payert please review this PR
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] sziszo commented on a change in pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
sziszo commented on a change in pull request #3208:
URL: https://github.com/apache/ambari/pull/3208#discussion_r465032411
##########
File path: ambari-server/src/main/java/org/apache/ambari/server/controller/AmbariHandlerList.java
##########
@@ -251,6 +251,10 @@ private WebAppContext getHandler(ViewInstanceEntity viewInstanceDefinition)
webAppContext.addFilter(new FilterHolder(springSecurityFilter), "/*", AmbariServer.DISPATCHER_TYPES);
webAppContext.setAllowNullPathInfo(true);
+ if (webAppContext.getErrorHandler() != null) {
+ webAppContext.getErrorHandler().setShowStacks(false);
Review comment:
I couldn't find a config property that I could use so I introduced a new one to display the error stacks. @hapylestat please review it
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] payert commented on pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
payert commented on pull request #3208:
URL: https://github.com/apache/ambari/pull/3208#issuecomment-667989996
I agree with the suggestion of making it configurable. Otherwise LGTM.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [ambari] hapylestat merged pull request #3208: AMBARI-25353 Seeing an error stack when running an API call against Ambari server (santal)
Posted by GitBox <gi...@apache.org>.
hapylestat merged pull request #3208:
URL: https://github.com/apache/ambari/pull/3208
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org