You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hbase.apache.org by "stack (JIRA)" <ji...@apache.org> on 2016/02/25 15:32:18 UTC

[jira] [Created] (HBASE-15328) Unvalidated Redirect in HMaster

stack created HBASE-15328:
-----------------------------

             Summary: Unvalidated Redirect in HMaster
                 Key: HBASE-15328
                 URL: https://issues.apache.org/jira/browse/HBASE-15328
             Project: HBase
          Issue Type: Bug
          Components: security
            Reporter: stack
            Priority: Minor


See OWASP page on why we should clean it up someday:

https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

Here is where we do the redirect:

{code}
    @Override
    public void doGet(HttpServletRequest request,
        HttpServletResponse response) throws ServletException, IOException {
      String redirectUrl = request.getScheme() + "://"
        + request.getServerName() + ":" + regionServerInfoPort
        + request.getRequestURI();
      response.sendRedirect(redirectUrl);
    }
  }
{code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)