This is an automated email from the ASF dual-hosted git repository.
dongjoon pushed a commit to branch branch-2.4
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/branch-2.4 by this push:
new 92b9706 [SPARK-29556][CORE] Avoid putting request path in error
response in ErrorServlet
92b9706 is described below
commit 92b9706afa69a818897b97918a527eccc108256a
Author: Sean Owen <[email protected]>
AuthorDate: Tue Oct 22 14:14:59 2019 -0700
[SPARK-29556][CORE] Avoid putting request path in error response in
ErrorServlet
### What changes were proposed in this pull request?
Don't include `$path` from user query in the error response.
### Why are the changes needed?
The path could contain input that is then rendered as HTML in the error
response. It's not clear whether it's exploitable, but better safe than sorry
as the path info really isn't that important in this context.
### Does this PR introduce any user-facing change?
No
### How was this patch tested?
Existing tests.
Closes #26211 from srowen/SPARK-29556.
Authored-by: Sean Owen <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
(cherry picked from commit 80094688fdbf5cc0d10c295fadb92965b460de5d)
Signed-off-by: Dongjoon Hyun <[email protected]>
---
.../main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git
a/core/src/main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala
b/core/src/main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala
index e59bf3f..f60d940 100644
---
a/core/src/main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala
+++
b/core/src/main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala
@@ -317,8 +317,7 @@ private class ErrorServlet extends RestServlet {
versionMismatch = true
s"Unknown protocol version '$unknownVersion'."
case _ =>
- // never reached
- s"Malformed path $path."
+ "Malformed path."
}
msg += s" Please submit requests through
http://[host]:[port]/$serverVersion/submissions/...";
val error = handleError(msg)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
