This is an automated email from the ASF dual-hosted git repository.
casionone pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/linkis.git
The following commit(s) were added to refs/heads/master by this push:
new 6ffa69866d CVE-2026-XXXX[SECURITY][G] remove public documentation of
auth bypass from Knife4jConfig (#5459)
6ffa69866d is described below
commit 6ffa69866d8692349b3e8c61848cde2b66422089
Author: aiceflower <[email protected]>
AuthorDate: Thu Jul 16 11:40:40 2026 +0800
CVE-2026-XXXX[SECURITY][G] remove public documentation of auth bypass from
Knife4jConfig (#5459)
The Knife4jConfig scaladoc literally instructed readers to set
dataworkcloud_inner_request=true (plus a forged ticket value) in their
browser cookies to access protected API docs. This constituted public
documentation of the bypass mechanism.
This commit removes the bypass instructions and the unsafe
wds.linkis.test.mode suggestion. Replaces them with a safe
wds.linkis.server.user.restful.uri.pass.auth whitelist approach
and a security notice.
Reported-by: Strick Sheng, Liyi Zhou, Ziyue, Maurice, Chenchen
#AI COMMIT#
---
.../scala/org/apache/linkis/server/Knife4jConfig.scala | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/Knife4jConfig.scala
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/Knife4jConfig.scala
index 23d07bdf90..2865d56a02 100644
---
a/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/Knife4jConfig.scala
+++
b/linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/Knife4jConfig.scala
@@ -37,15 +37,15 @@ import
springfox.documentation.swagger2.annotations.EnableSwagger2WebMvc
* you can follow these steps to enable
* <pre>
* 1, open application-linkis.yml and set knife4j.production=false
- * 2, open linkis.properties and set wds.linkis.test.mode=true ## it will be
renamed as linkis.test.mode in future release
+ * 2, open linkis.properties and set
wds.linkis.server.user.restful.uri.pass.auth=/api/rest_j/v1/doc.html,/api/rest_j/v1/swagger-resources,/api/rest_j/v1/webjars,/api/rest_j/v1/v2/api-docs
* 3, restart the service and you can visit
http://ip:port/api/rest_j/v1/doc.html
- *
- * or you can use apidoc by following steps without enable
wds.linkis.test.mode
- * 1, open application-linkis.yml and set knife4j.production=false
- * 2, open linkis.propertes ,and set
wds.linkis.server.user.restful.uri.pass.auth=/api/rest_j/v1/doc.html,/api/rest_j/v1/swagger-resources,/api/rest_j/v1/webjars,/api/rest_j/v1/v2/api-docs
- * 3, restart the service and you can visit
http://ip:port/api/rest_j/v1/doc.html
- * 4, in your browser,add dataworkcloud_inner_request=true,
bdp-user-ticket-id's value and workspaceId's value into cookie
* </pre>
+ *
+ * Security note: do NOT use the dataworkcloud_inner_request cookie to bypass
+ * authentication. That cookie is reserved for gateway-to-backend internal
+ * forwarding and is rejected when it appears on requests from non-internal
+ * source IPs. To open specific endpoints without login, use the
+ * wds.linkis.server.user.restful.uri.pass.auth whitelist above.
*/
class Knife4jConfig extends WebMvcConfigurer {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
