Repository: hbase Updated Branches: refs/heads/branch-1 0128fed9d -> b2705cc6b
HBASE-21275 - Thrift Server (branch 1 fix) -> Disable TRACE HTTP method for thrift http server (branch 1 only) Project: http://git-wip-us.apache.org/repos/asf/hbase/repo Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/b2705cc6 Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/b2705cc6 Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/b2705cc6 Branch: refs/heads/branch-1 Commit: b2705cc6b39963da3ccb8e20ae8ba2cd6f39a315 Parents: 0128fed Author: Wellington Chevreuil <wellingtonchevreuil@ChevreuilWellington-MBP15.local> Authored: Mon Oct 15 12:35:20 2018 +0100 Committer: Michael Stack <st...@apache.org> Committed: Tue Oct 16 22:35:18 2018 -0700 ---------------------------------------------------------------------- .../hadoop/hbase/thrift/ThriftServerRunner.java | 4 +- .../hbase/thrift/TestThriftHttpServer.java | 70 ++++++++++++++++---- 2 files changed, 59 insertions(+), 15 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/hbase/blob/b2705cc6/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java ---------------------------------------------------------------------- diff --git a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java index 71186d5..bfcaf7d 100644 --- a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java +++ b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java @@ -129,6 +129,7 @@ import org.mortbay.jetty.Server; import org.mortbay.jetty.nio.SelectChannelConnector; import org.mortbay.jetty.servlet.Context; import org.mortbay.jetty.servlet.ServletHolder; +import org.mortbay.jetty.webapp.WebAppContext; import org.mortbay.thread.QueuedThreadPool; import com.google.common.base.Joiner; @@ -421,8 +422,9 @@ public class ThriftServerRunner implements Runnable { httpServer = new Server(); // Context handler - Context context = new Context(httpServer, "/", Context.SESSIONS); + Context context = new WebAppContext(); context.setContextPath("/"); + context.setResourceBase("hbase-webapps/"); String httpPath = "/*"; httpServer.setHandler(context); context.addServlet(new ServletHolder(thriftHttpServlet), httpPath); http://git-wip-us.apache.org/repos/asf/hbase/blob/b2705cc6/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java ---------------------------------------------------------------------- diff --git a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java index ed91a29..c5b305d 100644 --- a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java +++ b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java @@ -18,6 +18,7 @@ */ package org.apache.hadoop.hbase.thrift; +import static org.junit.Assert.assertEquals; import static org.junit.Assert.assertFalse; import static org.junit.Assert.assertNull; import static org.junit.Assert.fail; @@ -152,6 +153,46 @@ public class TestThriftHttpServer { runThriftServer(0); } + @Test + public void testThriftServerHttpTraceForbiddenWhenOptionsDisabled() throws Exception { + // HTTP TRACE method should be disabled for security + // See https://www.owasp.org/index.php/Cross_Site_Tracing + checkHttpMethods("TRACE", HttpURLConnection.HTTP_FORBIDDEN); + } + + @Test + public void testThriftServerHttpTraceForbiddenWhenOptionsEnabled() throws Exception { + // HTTP TRACE method should be disabled for security + // See https://www.owasp.org/index.php/Cross_Site_Tracing + TEST_UTIL.getConfiguration().setBoolean(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD, + true); + checkHttpMethods("TRACE", HttpURLConnection.HTTP_FORBIDDEN); + } + + @Test + public void testThriftServerHttpOptionsForbiddenWhenOptionsDisabled() throws Exception { + // HTTP OPTIONS method should be disabled by default, so we make sure + // hbase.thrift.http.allow.options.method is not set anywhere in the config + TEST_UTIL.getConfiguration().unset(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD); + checkHttpMethods("OPTIONS", HttpURLConnection.HTTP_FORBIDDEN); + } + + @Test + public void testThriftServerHttpOptionsOkWhenOptionsEnabled() throws Exception { + TEST_UTIL.getConfiguration().setBoolean(ThriftServerRunner.THRIFT_HTTP_ALLOW_OPTIONS_METHOD, + true); + checkHttpMethods("OPTIONS", HttpURLConnection.HTTP_OK); + } + + private void waitThriftServerStartup() throws Exception{ + // wait up to 10s for the server to start + for (int i = 0; i < 100 + && ( thriftServer.serverRunner == null || thriftServer.serverRunner.httpServer == + null); i++) { + Thread.sleep(100); + } + } + private void runThriftServer(int customHeaderSize) throws Exception { List<String> args = new ArrayList<String>(); port = HBaseTestingUtility.randomFreePort(); @@ -162,16 +203,10 @@ public class TestThriftHttpServer { thriftServer = new ThriftServer(TEST_UTIL.getConfiguration()); startHttpServerThread(args.toArray(new String[args.size()])); - // wait up to 10s for the server to start - for (int i = 0; i < 100 - && ( thriftServer.serverRunner == null || thriftServer.serverRunner.httpServer == - null); i++) { - Thread.sleep(100); - } + waitThriftServerStartup(); String url = "http://"+ HConstants.LOCALHOST + ":" + port; try { - checkHttpMethods(url); talkToThriftServer(url, customHeaderSize); } catch (Exception ex) { clientSideException = ex; @@ -189,13 +224,20 @@ public class TestThriftHttpServer { } } - private void checkHttpMethods(String url) throws Exception { - // HTTP TRACE method should be disabled for security - // See https://www.owasp.org/index.php/Cross_Site_Tracing - HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection(); - conn.setRequestMethod("TRACE"); - conn.connect(); - Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode()); + private void checkHttpMethods(String httpRequestMethod, + int httpExpectedResponse) throws Exception { + port = HBaseTestingUtility.randomFreePort(); + thriftServer = new ThriftServer(TEST_UTIL.getConfiguration()); + try { + startHttpServerThread(new String[] { "-port", String.valueOf(port), "start" }); + waitThriftServerStartup(); + final URL url = new URL("http://"+ HConstants.LOCALHOST + ":" + port); + final HttpURLConnection httpConn = (HttpURLConnection) url.openConnection(); + httpConn.setRequestMethod(httpRequestMethod); + assertEquals(httpExpectedResponse, httpConn.getResponseCode()); + } finally { + stopHttpServerThread(); + } } private static volatile boolean tableCreated = false;