You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@hive.apache.org by "Ádám Szita (Jira)" <ji...@apache.org> on 2019/11/25 10:01:00 UTC

[jira] [Created] (HIVE-22533) Fix possible LLAP daemon web UI vulnerabilities

Ádám Szita created HIVE-22533:
---------------------------------

             Summary: Fix possible LLAP daemon web UI vulnerabilities
                 Key: HIVE-22533
                 URL: https://issues.apache.org/jira/browse/HIVE-22533
             Project: Hive
          Issue Type: Improvement
          Components: llap
            Reporter: Ádám Szita
            Assignee: Ádám Szita


Security tools that look for possible vulnerabilities find issues with LLAP daemon web UI:
 * *dir listing* for _images,css,js_ folders 

 * *missing X-Frame-Options response header* in the response

Similarly we should disable dir listing on HS2 web UI /static page too, as it is of no use anyway.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)