You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "caishunfeng (via GitHub)" <gi...@apache.org> on 2024/03/07 04:08:47 UTC
[PR] [Fix] add black key for switch task [dolphinscheduler]
caishunfeng opened a new pull request, #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680
## Purpose of the pull request
- add some black keys for switch task
## Brief change log
- `SwitchTaskUtils`
## Verify this pull request
- Added UT to verify the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2003724465
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "caishunfeng (via GitHub)" <gi...@apache.org>.
caishunfeng commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1983332076
> Is it hard to cover all types inject via block list, I think
You mean whitelist?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1991331280
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "caishunfeng (via GitHub)" <gi...@apache.org>.
caishunfeng commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1986738198
Maybe we can add the black key in common config? WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "zhongjiajie (via GitHub)" <gi...@apache.org>.
zhongjiajie commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1987056204
> > Is it hard to cover all types inject via block list, I think
>
> If attackers try to inject code, I think it is hardly possible for them to bypass using `().[]`.
Can they use encode and decode libs to bypass?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "zhongjiajie (via GitHub)" <gi...@apache.org>.
zhongjiajie commented on code in PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#discussion_r1515999986
##########
dolphinscheduler-master/src/main/java/org/apache/dolphinscheduler/server/master/utils/SwitchTaskUtils.java:
##########
@@ -50,6 +50,10 @@ public class SwitchTaskUtils {
"eval",
"function",
"import",
+ ".",
+ "()",
+ "[",
+ "]",
Review Comment:
can we get the final exec command in user input? such as we can convert below code
```js
var a = Java.type("ja" + "va.lang.Runtime");
var b = a.getRuntime();
b.exec(${cmd})
```
to
```js
var a = Java.type("ja" + "va.lang.Runtime");
var b = a.getRuntime();
Java.type("ja" + "va.lang.Runtime").getRuntime().exec(${cmd})
```
If we can do it, I think that would be easier to check
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "EricGao888 (via GitHub)" <gi...@apache.org>.
EricGao888 commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1983393911
> Is it hard to cover all types inject via block list, I think
If attackers try to inject code, I think it is hardly possible for them to bypass using `().[]`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "zhongjiajie (via GitHub)" <gi...@apache.org>.
zhongjiajie commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1983310903
Is it hard to cover all types inject via block list, I think
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "caishunfeng (via GitHub)" <gi...@apache.org>.
caishunfeng commented on code in PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#discussion_r1516018204
##########
dolphinscheduler-master/src/main/java/org/apache/dolphinscheduler/server/master/utils/SwitchTaskUtils.java:
##########
@@ -50,6 +50,10 @@ public class SwitchTaskUtils {
"eval",
"function",
"import",
+ ".",
+ "()",
+ "[",
+ "]",
Review Comment:
It's hard to convert because the code are executed in js engine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2002767594
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "caishunfeng (via GitHub)" <gi...@apache.org>.
caishunfeng commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2003675365
> > Maybe it's better to add the black keys in common config? WDYT? @zhongjiajie @EricGao888
>
> I think current solution in this PR (hard-coded black key) is good enough. If we make the black keys configurable, we also need to add comments above the config to warn users of this risk.
OK
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "EricGao888 (via GitHub)" <gi...@apache.org>.
EricGao888 merged PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1991320582
## [Codecov](https://app.codecov.io/gh/apache/dolphinscheduler/pull/15680?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 38.97%. Comparing base [(`738da1c`)](https://app.codecov.io/gh/apache/dolphinscheduler/commit/738da1cda3731543cdec61c249a051fbc99da929?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`6be32a9`)](https://app.codecov.io/gh/apache/dolphinscheduler/pull/15680?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> :exclamation: Current head 6be32a9 differs from pull request most recent head a835160. Consider uploading reports for the commit a835160 to get more accurate results
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## dev #15680 +/- ##
============================================
- Coverage 39.05% 38.97% -0.09%
+ Complexity 4845 4823 -22
============================================
Files 1316 1316
Lines 45011 44937 -74
Branches 4818 4803 -15
============================================
- Hits 17581 17515 -66
+ Misses 25524 25515 -9
- Partials 1906 1907 +1
```
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/dolphinscheduler/pull/15680?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-1991333743
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2003722698
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "EricGao888 (via GitHub)" <gi...@apache.org>.
EricGao888 commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2002753183
> Maybe it's better to add the black keys in common config? WDYT? @zhongjiajie @EricGao888
I think current solution in this PR (hard-coded black key) is good enough. If we make the black keys configurable, we also need to add comments above the config to warn users of this risk.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [WIP][Fix] add black key for switch task [dolphinscheduler]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #15680:
URL: https://github.com/apache/dolphinscheduler/pull/15680#issuecomment-2002768423
## [](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache-dolphinscheduler&pullRequest=15680&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache-dolphinscheduler&pullRequest=15680&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache-dolphinscheduler&pullRequest=15680)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org