This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git

commit 866acd2fcfdb9b94316b0d321b89ee512a081702
Author: Richard Zowalla <[email protected]>
AuthorDate: Mon Apr 13 20:02:28 2026 +0200

     Hardening: use POST for profiling/debugging REST endpoints (#8515)
---
 docs/STORM-UI-REST-API.md                                | 14 +++++++-------
 .../org/apache/storm/daemon/ui/WEB-INF/component.html    | 16 ++++++++--------
 .../storm/daemon/ui/resources/StormApiResource.java      | 12 ++++++------
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/docs/STORM-UI-REST-API.md b/docs/STORM-UI-REST-API.md
index b4f1d9b1f..bf99960f0 100644
--- a/docs/STORM-UI-REST-API.md
+++ b/docs/STORM-UI-REST-API.md
@@ -1298,9 +1298,9 @@ Sample response:
 }
 ```
 
-## Profiling and Debugging GET Operations
+## Profiling and Debugging POST Operations
 
-###  /api/v1/topology/\<id\>/profiling/start/\<host-port\>/\<timeout\> (GET)
+###  /api/v1/topology/\<id\>/profiling/start/\<host-port\>/\<timeout\> (POST)
 
 Request to start profiler on worker with timeout. Returns status and link to 
profiler artifacts for worker.
 Substitute appropriate values for \<id\>, \<host-port\> and \<timeout\>.
@@ -1339,7 +1339,7 @@ Sample response:
 }
 ```
 
-###  /api/v1/topology/\<id\>/profiling/dumpprofile/\<host-port\> (GET)
+###  /api/v1/topology/\<id\>/profiling/dumpprofile/\<host-port\> (POST)
 
 Request to dump profiler recording on worker. Returns status and worker id for 
the request.
 Substitute for \<id\> and \<host-port\>. 
@@ -1371,7 +1371,7 @@ Sample response:
 }
 ```
 
-###  /api/v1/topology/\<id\>/profiling/stop/\<host-port\> (GET)
+###  /api/v1/topology/\<id\>/profiling/stop/\<host-port\> (POST)
 
 Request to stop profiler on worker. Returns status and worker id for the 
request.
 Substitute for \<id\> and \<host-port\>. 
@@ -1403,7 +1403,7 @@ Sample response:
 }
 ```
 
-###  /api/v1/topology/\<id\>/profiling/dumpjstack/\<host-port\> (GET)
+###  /api/v1/topology/\<id\>/profiling/dumpjstack/\<host-port\> (POST)
 
 Request to dump jstack on worker. Returns status and worker id for the request.
 Substitute for \<id\> and \<host-port\>. 
@@ -1435,7 +1435,7 @@ Sample response:
 }
 ```
 
-###  /api/v1/topology/\<id\>/profiling/dumpheap/\<host-port\> (GET)
+###  /api/v1/topology/\<id\>/profiling/dumpheap/\<host-port\> (POST)
 
 Request to dump heap (jmap) on worker. Returns status and worker id for the 
request.
 Substitute for \<id\> and \<host-port\>. 
@@ -1467,7 +1467,7 @@ Sample response:
 }
 ```
 
-###  /api/v1/topology/\<id\>/profiling/restartworker/\<host-port\> (GET)
+###  /api/v1/topology/\<id\>/profiling/restartworker/\<host-port\> (POST)
 
 Request to request the worker. Returns status and worker id for the request.
 Substitute for \<id\> and \<host-port\>. 
diff --git 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/WEB-INF/component.html 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/WEB-INF/component.html
index 3d1000c0d..8ce87f260 100644
--- 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/WEB-INF/component.html
+++ 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/WEB-INF/component.html
@@ -386,7 +386,7 @@ function start_profiling() {
     var passed = {}
     Object.keys(workerActionSelected).forEach(function (id) {
         var url = "/api/v1/topology/"+topologyId+"/profiling/start/" + id + 
"/" + timeout;
-        $.get(url, function(response,status,jqXHR) {
+        $.post(url, function(response,status,jqXHR) {
             jsError(function() {
                 getStatic("/templates/component-page-template.html", 
function(template) {
                     var host_port_split = id.split(":");
@@ -428,7 +428,7 @@ function stop_profiling(id) {
     $("#stop_" + id).prop('disabled', true);
     setTimeout(function(){ $("#stop_" + id).prop('disabled', false); }, 5000);
     
-    $.get(url, function(response,status,jqXHR) {
+    $.post(url, function(response,status,jqXHR) {
         alert("Submitted request to stop profiling...");
     })
     .fail(function(response) {
@@ -445,7 +445,7 @@ function dump_profile(id) {
     $("#dump_profile_" + id).prop('disabled', true);
     setTimeout(function(){ $("#dump_profile_" + id).prop('disabled', false); 
}, 5000);
     
-    $.get(url, function(response,status,jqXHR) {
+    $.post(url, function(response,status,jqXHR) {
         alert("Submitted request to dump profile snapshot...");
     })
     .fail(function(response) {
@@ -465,7 +465,7 @@ function dump_jstacks() {
         $("#dump_jstack_" + id).prop('disabled', true);
         setTimeout(function(){ $("#dump_jstack_" + id).prop('disabled', 
false); }, 5000);
 
-        $.get(url).fail(function(response) {
+        $.post(url).fail(function(response) {
             failed[id] = response;
         });
         if (!(id in failed)) {
@@ -490,7 +490,7 @@ function dump_jstack(id) {
     $("#dump_jstack_" + id).prop('disabled', true);
     setTimeout(function(){ $("#dump_jstack_" + id).prop('disabled', false); }, 
5000);
     
-    $.get(url, function(response,status,jqXHR) {
+    $.post(url, function(response,status,jqXHR) {
         alert("Submitted request for jstack dump...");
     })
     .fail(function(response) {
@@ -509,7 +509,7 @@ function restart_worker_jvms() {
         $("#restart_worker_jvm_" + id).prop('disabled', true);
         setTimeout(function(){ $("#restart_worker_jvm_" + id).prop('disabled', 
false); }, 5000);
 
-        $.get(url).fail(function(response) {
+        $.post(url).fail(function(response) {
             failed[id] = response;
         });
         if (!(id in failed)) {
@@ -537,7 +537,7 @@ function dump_heaps() {
         $("#dump_heap_" + id).prop('disabled', true);
         setTimeout(function(){ $("#dump_heap_" + id).prop('disabled', false); 
}, 5000);
 
-        $.get(url).fail(function(response) {
+        $.post(url).fail(function(response) {
             failed[id] = response;
         });
         if (!(id in failed)) {
@@ -562,7 +562,7 @@ function dump_heap(id) {
     $("#dump_heap_" + id).prop('disabled', true);
     setTimeout(function(){ $("#dump_heap_" + id).prop('disabled', false); }, 
5000);
     
-    $.get(url, function(response,status,jqXHR) {
+    $.post(url, function(response,status,jqXHR) {
         alert("Submitted request for jmap dump...");
     })
     .fail(function(response) {
diff --git 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/resources/StormApiResource.java
 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/resources/StormApiResource.java
index d37826f25..62b461992 100644
--- 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/resources/StormApiResource.java
+++ 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/resources/StormApiResource.java
@@ -596,7 +596,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/start/:host-port/:timeout -> profiling 
start.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/start/{host-port}/{timeout}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")
@@ -615,7 +615,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/stop/:host-port -> profiling stop.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/stop/{host-port}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")
@@ -633,7 +633,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/dumpprofile/:host-port -> dump profile.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/dumpprofile/{host-port}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")
@@ -651,7 +651,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/dumpjstack/:host-port -> dump jstack.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/dumpjstack/{host-port}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")
@@ -671,7 +671,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/restartworker/:host-port -> restart 
worker.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/restartworker/{host-port}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")
@@ -691,7 +691,7 @@ public class StormApiResource {
     /**
      * /api/v1/topology/:id/profiling/dumpheap/:host-port -> dump heap.
      */
-    @GET
+    @POST
     @Path("/topology/{id}/profiling/dumpheap/{host-port}")
     @AuthNimbusOp(value = "setWorkerProfiler", needsTopoId = true)
     @Produces("application/json")

Reply via email to