This is an automated email from the ASF dual-hosted git repository.
casionone pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/linkis.git
The following commit(s) were added to refs/heads/master by this push:
new bb26ad3631 [SECURITY][A] remove default wds.linkis.crypt.key,
fail-closed on insecure values (#5456)
bb26ad3631 is described below
commit bb26ad3631906e9574db9bd512d77d37f32532ed
Author: aiceflower <[email protected]>
AuthorDate: Thu Jul 16 11:35:09 2026 +0800
[SECURITY][A] remove default wds.linkis.crypt.key, fail-closed on insecure
values (#5456)
- Remove hardcoded default 'bdp-for-server' cryptKey
- Add startup validation: empty / legacy default / short keys cause
fail-closed
- Add escape hatch: linkis.crypt.key.allow.insecure=true (default false)
- Add CRYPT_KEY_INSECURE error code
Reported-by: Strick Sheng, Liyi Zhou, Ziyue, Maurice, Chenchen
Co-authored-by: ASF Security review
#AI COMMIT#
---
.../linkis/server/conf/ServerConfiguration.scala | 42 ++++++++++++++++++++--
1 file changed, 39 insertions(+), 3 deletions(-)
diff --git
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/conf/ServerConfiguration.scala
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/conf/ServerConfiguration.scala
index ed6c680648..6b618de064 100644
---
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/conf/ServerConfiguration.scala
+++
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/conf/ServerConfiguration.scala
@@ -47,9 +47,45 @@ object ServerConfiguration extends Logging {
)
}
- val cryptKey = Base64.getMimeEncoder.encodeToString(
- CommonVars("wds.linkis.crypt.key", "bdp-for-server").getValue.getBytes
- )
+ // CVE-2026-XXXX (session ticket auth bypass): remove hardcoded default
cryptKey
+ private val INSECURE_DEFAULTS = Set("bdp-for-server", "")
+ private val CRYPT_KEY_MIN_LENGTH = 16
+
+ private val cryptKeyRaw: String = CommonVars("wds.linkis.crypt.key",
"").getValue
+ private val allowInsecureCryptKey: Boolean =
CommonVars("linkis.crypt.key.allow.insecure", "false").getValue.toBoolean
+
+ private def validateCryptKey(key: String): Unit = {
+ val issues = scala.collection.mutable.ArrayBuffer.empty[String]
+ if (key == null || key.isEmpty) {
+ issues += "wds.linkis.crypt.key not set"
+ } else {
+ if (INSECURE_DEFAULTS.contains(key)) {
+ issues += s"wds.linkis.crypt.key is the insecure default '$key'"
+ }
+ if (key.length < CRYPT_KEY_MIN_LENGTH) {
+ issues += s"wds.linkis.crypt.key length ${key.length} <
$CRYPT_KEY_MIN_LENGTH"
+ }
+ }
+ if (issues.nonEmpty) {
+ if (allowInsecureCryptKey) {
+ logger.error("=" * 72)
+ logger.error("INSECURE CRYPT KEY IN USE — session ticket forgery
risk!")
+ issues.foreach(s => logger.error(s" - $s"))
+ logger.error("Rotate wds.linkis.crypt.key to a random 24+ char value
immediately.")
+ logger.error("=" * 72)
+ } else {
+ throw new BDPInitServerException(
+ CRYPT_KEY_INSECURE.getErrorCode,
+ s"${CRYPT_KEY_INSECURE.getErrorDesc}: ${issues.mkString("; ")} " +
+ "(override with -Dlinkis.crypt.key.allow.insecure=true AT YOUR OWN
RISK)"
+ )
+ }
+ }
+ }
+
+ validateCryptKey(cryptKeyRaw)
+
+ val cryptKey = Base64.getMimeEncoder.encodeToString(cryptKeyRaw.getBytes)
private val ticketHeader = CommonVars("wds.linkis.ticket.header",
"bfs_").getValue
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
