You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@kylin.apache.org by "liyang (Jira)" <ji...@apache.org> on 2024/09/27 15:21:00 UTC

[jira] [Closed] (KYLIN-5706) Fix the command line injection vulnerability when generating diagnostic packages through scripts

     [ https://issues.apache.org/jira/browse/KYLIN-5706?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

liyang closed KYLIN-5706.
-------------------------

> Fix the command line injection vulnerability when generating diagnostic packages through scripts
> ------------------------------------------------------------------------------------------------
>
>                 Key: KYLIN-5706
>                 URL: https://issues.apache.org/jira/browse/KYLIN-5706
>             Project: Kylin
>          Issue Type: Bug
>    Affects Versions: 5.0-beta
>            Reporter: Hongrong Cao
>            Assignee: Zhiting Guo
>            Priority: Major
>             Fix For: 5.0.0
>
>
> The diagnostic package will call the command line to execute the shell script through java, and kylin does not escape the input from the user, and directly splices it into the command line, resulting in command line injection.
> Therefore, we need to escape the user input that will be spliced into the cmd.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)