[jira] [Commented] (IMPALA-15345) To do

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/IMPALA-15345?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18121262#comment-18121262 ] 

ASF subversion and git services commented on IMPALA-15345:
----------------------------------------------------------

Commit 8cfaf9b5a62522b409ed6a52ec0d322f6b4c2407 in impala's branch refs/heads/branch-4.5.3 from Michael Smith
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=8cfaf9b5a ]

IMPALA-15345: Resolve '..' segments before trusted_jar_paths check

BackendConfig.isJarPathAllowed() compared the raw driver.url / HDFS
location string against the configured --trusted_jar_paths prefixes
using String#startsWith(). That string is later turned into a Hadoop
Path and resolved by the filesystem, which collapses '.' and '..'
segments. A URL such as '<trusted_dir>/../../secret.jar' therefore
passed the prefix check while actually resolving to a JAR outside the
trusted directory, letting Impala load and execute attacker-controlled
code in impalad.

Resolve both the candidate path and each allowlist entry through
Hadoop's Path class (which performs the same '.'/'..' collapsing)
before comparing, and require the resolved path to be nested inside,
or equal to, a resolved trusted directory rather than merely share a
string prefix.

Testing:
- Added BackendConfigTest cases covering '..'-escape rejection,
  legitimate in-directory '..'/'.' usage, sibling-directory-name
  spoofing, and malformed allowlist entries.

Change-Id: I4288aba344d7d0cd07c9fb8281fc8d3c0490e432
Assisted-by: Claude Sonnet 5 (GitHub Copilot)


> To do
> -----
>
>                 Key: IMPALA-15345
>                 URL: https://issues.apache.org/jira/browse/IMPALA-15345
>             Project: IMPALA
>          Issue Type: Bug
>            Reporter: Michael Smith
>            Assignee: Michael Smith
>            Priority: Major
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-all-unsubscribe@impala.apache.org
For additional commands, e-mail: issues-all-help@impala.apache.org