[
https://issues.apache.org/jira/browse/HDFS-17966?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Zita Dombi updated HDFS-17966:
------------------------------
Description:
WebHDFS operations that accept a path, entity name, or metadata string as an
HTTP query parameter (e.g. RENAME, CONCAT, etc.) automatically HTML-encode
special characters ({{{}&{}}}, {{{}<{}}}, {{{}>{}}}, {{{}"{}}}, {{{}'{}}}).
For example, renaming a file to a target path containing {{&}} results in
{code:java}
&{code}
being written literally to HDFS. Native WebHDFS handles these operations
correctly without corrupting the path.
1. HttpFS
{code:java}
curl -X PUT
"https://<host>:14000/webhdfs/v1/user/admin/httpfstest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fhttpfstest1%26"
hdfs dfs -ls /user/admin/ | grep httpfstest
# Result: /user/admin/httpfstest1&
{code}
2. Native WebHDFS
{code:java}
curl -X PUT
"https://<active-namenode>:20102/webhdfs/v1/user/admin/nativetest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fnativetest1%26"
hdfs dfs -ls /user/admin/ | grep nativetest
# Result: /user/admin/nativetest1&
{code}
HttpServer2 registers a global XSS protection filter, QuotingInputFilter. Its
`quoteHtmlChars()` explicitly converts reserved characters in query parameters
before HttpFS processes them. Native WebHDFS does not apply this filter and
parses parameters directly via JAX-RS, keeping the original path intact.
Thanks [~ayushguptatech] for finding this!
was:
WebHDFS operations that accept a path, entity name, or metadata string as an
HTTP query parameter (e.g. RENAME, CONCAT, etc.) automatically HTML-encode
special characters ({{{}&{}}}, {{{}<{}}}, {{{}>{}}}, {{{}"{}}}, {{{}'{}}}).
For example, renaming a file to a target path containing {{&}} results in
{code:java}
&{code}
being written literally to HDFS. Native WebHDFS handles these operations
correctly without corrupting the path.
1. HttpFS
{code:java}
curl -X PUT
"https://<host>:14000/webhdfs/v1/user/admin/httpfstest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fhttpfstest1%26"
hdfs dfs -ls /user/admin/ | grep httpfstest
# Result: /user/admin/httpfstest1&
{code}
2. Native WebHDFS
{code:java}
curl -X PUT
"https://<active-namenode>:20102/webhdfs/v1/user/admin/nativetest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fnativetest1%26"
hdfs dfs -ls /user/admin/ | grep nativetest
# Result: /user/admin/nativetest1&
{code}
HttpServer2 registers a global XSS protection filter, QuotingInputFilter. Its
`quoteHtmlChars()` explicitly converts reserved characters in query parameters
before HttpFS processes them. Native WebHDFS does not apply this filter and
parses parameters directly via JAX-RS, keeping the original path intact.
> HttpFS: Path parameters with special characters are HTML-encoded by
> QuotingInputFilter, corrupting paths
> --------------------------------------------------------------------------------------------------------
>
> Key: HDFS-17966
> URL: https://issues.apache.org/jira/browse/HDFS-17966
> Project: Hadoop HDFS
> Issue Type: Bug
> Reporter: Zita Dombi
> Priority: Major
>
> WebHDFS operations that accept a path, entity name, or metadata string as an
> HTTP query parameter (e.g. RENAME, CONCAT, etc.) automatically HTML-encode
> special characters ({{{}&{}}}, {{{}<{}}}, {{{}>{}}}, {{{}"{}}}, {{{}'{}}}).
> For example, renaming a file to a target path containing {{&}} results in
> {code:java}
> &{code}
> being written literally to HDFS. Native WebHDFS handles these operations
> correctly without corrupting the path.
> 1. HttpFS
> {code:java}
> curl -X PUT
> "https://<host>:14000/webhdfs/v1/user/admin/httpfstest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fhttpfstest1%26"
> hdfs dfs -ls /user/admin/ | grep httpfstest
> # Result: /user/admin/httpfstest1&
> {code}
> 2. Native WebHDFS
> {code:java}
> curl -X PUT
> "https://<active-namenode>:20102/webhdfs/v1/user/admin/nativetest1?op=RENAME&destination=%2Fuser%2Fadmin%2Fnativetest1%26"
> hdfs dfs -ls /user/admin/ | grep nativetest
> # Result: /user/admin/nativetest1&
> {code}
> HttpServer2 registers a global XSS protection filter, QuotingInputFilter. Its
> `quoteHtmlChars()` explicitly converts reserved characters in query
> parameters before HttpFS processes them. Native WebHDFS does not apply this
> filter and parses parameters directly via JAX-RS, keeping the original path
> intact.
> Thanks [~ayushguptatech] for finding this!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
