This is an automated email from the ASF dual-hosted git repository.
zhuqi pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/hadoop.git
The following commit(s) were added to refs/heads/trunk by this push:
new 05b6a1a YARN-10833. Set the X-FRAME-OPTIONS header for the default
contexts. (#3203)
05b6a1a is described below
commit 05b6a1a06aff41322dd08ee8a0b4df04fd84d6da
Author: Benjamin Teke <brumi1...@users.noreply.github.com>
AuthorDate: Sat Jul 24 05:44:21 2021 +0200
YARN-10833. Set the X-FRAME-OPTIONS header for the default contexts. (#3203)
* YARN-10833. Set the X-FRAME-OPTIONS header for the default contexts.
* fixup: YARN-10833. Set the X-FRAME-OPTIONS header for the default
contexts.
Co-authored-by: Benjamin Teke <bt...@cloudera.com>
---
.../org/apache/hadoop/yarn/webapp/WebApps.java | 31 ++---
.../hadoop/yarn/webapp/TestRMWithXFSFilter.java | 155 +++++++++------------
2 files changed, 76 insertions(+), 110 deletions(-)
diff --git
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/WebApps.java
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/WebApps.java
index 2f02fd7..a088f4b 100644
---
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/WebApps.java
+++
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/WebApps.java
@@ -41,7 +41,6 @@ import org.apache.hadoop.http.HttpServer2;
import org.apache.hadoop.security.UserGroupInformation;
import org.apache.hadoop.security.authorize.AccessControlList;
import org.apache.hadoop.security.http.RestCsrfPreventionFilter;
-import org.apache.hadoop.security.http.XFrameOptionsFilter;
import org.apache.hadoop.yarn.api.ApplicationClientProtocol;
import org.apache.hadoop.yarn.conf.YarnConfiguration;
import org.apache.hadoop.yarn.webapp.util.WebAppUtils;
@@ -325,6 +324,19 @@ public class WebApps {
YarnConfiguration.YARN_ADMIN_ACL,
YarnConfiguration.DEFAULT_YARN_ADMIN_ACL)))
.setPathSpec(pathList.toArray(new String[0]));
+
+ // Set the X-FRAME-OPTIONS header, use the HttpServer2 default if
+ // the header value is not specified
+ Map<String, String> xfsParameters =
+ getConfigParameters(xfsConfigPrefix);
+
+ if (xfsParameters != null) {
+ String xFrameOptions = xfsParameters.get("xframe-options");
+ if (xFrameOptions != null) {
+ builder.configureXFrame(hasXFSEnabled())
+ .setXFrameOption(xFrameOptions);
+ }
+ }
// Get port ranges from config.
IntegerRanges ranges = null;
if (portRangeConfigKey != null) {
@@ -395,15 +407,6 @@ public class WebApps {
new String[] {"/*"});
}
- params = getConfigParameters(xfsConfigPrefix);
-
- if (hasXFSEnabled()) {
- String xfsClassName = XFrameOptionsFilter.class.getName();
- HttpServer2.defineFilter(server.getWebAppContext(), xfsClassName,
- xfsClassName, params,
- new String[] {"/*"});
- }
-
HttpServer2.defineFilter(server.getWebAppContext(), "guice",
GuiceFilter.class.getName(), null, new String[] { "/*" });
@@ -489,14 +492,6 @@ public class WebApps {
HttpServer2.defineFilter(ui2Context, restCsrfClassName,
restCsrfClassName, params, new String[]{"/*"});
}
-
- params = getConfigParameters(xfsConfigPrefix);
-
- if (hasXFSEnabled()) {
- String xfsClassName = XFrameOptionsFilter.class.getName();
- HttpServer2.defineFilter(ui2Context, xfsClassName, xfsClassName,
params,
- new String[]{"/*"});
- }
}
private String inferHostClass() {
diff --git
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/webapp/TestRMWithXFSFilter.java
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/webapp/TestRMWithXFSFilter.java
index 2f7ecde..2054754 100644
---
a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/webapp/TestRMWithXFSFilter.java
+++
b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-resourcemanager/src/test/java/org/apache/hadoop/yarn/webapp/TestRMWithXFSFilter.java
@@ -18,126 +18,97 @@
package org.apache.hadoop.yarn.webapp;
-import com.google.inject.Guice;
-import com.google.inject.servlet.ServletModule;
-import com.sun.jersey.api.client.ClientResponse;
-import com.sun.jersey.api.client.WebResource;
-import com.sun.jersey.guice.spi.container.servlet.GuiceContainer;
-import com.sun.jersey.test.framework.WebAppDescriptor;
import org.apache.hadoop.conf.Configuration;
-import org.apache.hadoop.security.http.XFrameOptionsFilter;
+import org.apache.hadoop.http.HttpServer2;
import org.apache.hadoop.yarn.conf.YarnConfiguration;
import org.apache.hadoop.yarn.server.resourcemanager.MockRM;
-import org.apache.hadoop.yarn.server.resourcemanager.ResourceManager;
import
org.apache.hadoop.yarn.server.resourcemanager.scheduler.ResourceScheduler;
import
org.apache.hadoop.yarn.server.resourcemanager.scheduler.fifo.FifoScheduler;
-import
org.apache.hadoop.yarn.server.resourcemanager.webapp.JAXBContextResolver;
-import org.apache.hadoop.yarn.server.resourcemanager.webapp.RMWebServices;
-import org.junit.Before;
+import org.junit.After;
+import org.junit.Assert;
import org.junit.Test;
-import java.util.HashMap;
-import java.util.Map;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.URL;
/**
* Used TestRMWebServices as an example of web invocations of RM and added
* test for XFS Filter.
*/
-public class TestRMWithXFSFilter extends JerseyTestBase {
-
+public class TestRMWithXFSFilter {
private static MockRM rm;
- @Before
- @Override
- public void setUp() throws Exception {
- super.setUp();
- }
-
- public TestRMWithXFSFilter() {
- super(new WebAppDescriptor.Builder(
- "org.apache.hadoop.yarn.server.resourcemanager.webapp")
- .contextListenerClass(GuiceServletConfig.class)
- .filterClass(com.google.inject.servlet.GuiceFilter.class)
- .contextPath("jersey-guice-filter").servletPath("/").build());
+ private void createMockRm(final Boolean xfsEnabled,
+ final String xfsHeaderValue) {
+ Configuration conf = new Configuration();
+ conf.setClass(YarnConfiguration.RM_SCHEDULER, FifoScheduler.class,
+ ResourceScheduler.class);
+ conf.setBoolean("mockrm.webapp.enabled", true);
+ if (xfsEnabled != null) {
+ conf.setBoolean(YarnConfiguration.YARN_XFS_ENABLED, xfsEnabled);
+ }
+ if (xfsHeaderValue != null) {
+ conf.setStrings(YarnConfiguration.RM_XFS_OPTIONS, xfsHeaderValue);
+ }
+ rm = new MockRM(conf);
+ rm.start();
}
@Test
- public void testDefaultBehavior() throws Exception {
- createInjector();
-
- WebResource r = resource();
- ClientResponse response = r.path("ws").path("v1").path("cluster")
- .path("info").accept("application/xml")
- .get(ClientResponse.class);
- assertEquals("Should have received DENY x-frame options header",
- "DENY",
- response.getHeaders().get(XFrameOptionsFilter.X_FRAME_OPTIONS).get(0));
- }
-
- protected void createInjector(String headerValue) {
- createInjector(headerValue, false);
+ public void testXFrameOptionsDefaultBehaviour() throws Exception {
+ createMockRm(null, null);
+
+ URL url = new URL("http://localhost:8088/ws/v1/cluster/info";);
+ HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+ String xfoHeader = conn.getHeaderField("X-FRAME-OPTIONS");
+ Assert.assertTrue(xfoHeader.endsWith(HttpServer2.XFrameOption
+ .SAMEORIGIN.toString()));
}
-
- protected void createInjector() {
- createInjector(null, false);
+ @Test
+ public void testXFrameOptionsExplicitlyEnabled() throws Exception {
+ createMockRm(true, HttpServer2.XFrameOption
+ .SAMEORIGIN.toString());
+
+ URL url = new URL("http://localhost:8088/ws/v1/cluster/info";);
+ HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+ String xfoHeader = conn.getHeaderField("X-FRAME-OPTIONS");
+ Assert.assertTrue(xfoHeader.endsWith(HttpServer2.XFrameOption
+ .SAMEORIGIN.toString()));
}
- protected void createInjector(final String headerValue,
- final boolean explicitlyDisabled) {
- GuiceServletConfig.setInjector(Guice.createInjector(new ServletModule() {
- @Override
- protected void configureServlets() {
- bind(JAXBContextResolver.class);
- bind(RMWebServices.class);
- bind(GenericExceptionHandler.class);
- Configuration conf = new Configuration();
- conf.setClass(YarnConfiguration.RM_SCHEDULER, FifoScheduler.class,
- ResourceScheduler.class);
- rm = new MockRM(conf);
- bind(ResourceManager.class).toInstance(rm);
- serve("/*").with(GuiceContainer.class);
- XFrameOptionsFilter xfsFilter = new XFrameOptionsFilter();
- Map<String, String> initParams = new HashMap<>();
- if (headerValue != null) {
- initParams.put(XFrameOptionsFilter.CUSTOM_HEADER_PARAM, headerValue);
- }
- if (explicitlyDisabled) {
- initParams.put(
- "xframe-options-enabled", "false");
- }
-
- filter("/*").through(xfsFilter, initParams);
- }
- }));
+ @Test
+ public void testXFrameOptionsEnabledDefaultApps() throws Exception {
+ createMockRm(true, HttpServer2.XFrameOption
+ .SAMEORIGIN.toString());
+
+ URL url = new URL("http://localhost:8088/logs";);
+ HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+ String xfoHeader = conn.getHeaderField("X-FRAME-OPTIONS");
+ Assert.assertTrue(xfoHeader.endsWith(HttpServer2.XFrameOption
+ .SAMEORIGIN.toString()));
}
@Test
- public void testSameOrigin() throws Exception {
- createInjector("SAMEORIGIN");
+ public void testXFrameOptionsDisabled() throws Exception {
+ createMockRm(false, null);
- WebResource r = resource();
- ClientResponse response = r.path("ws").path("v1").path("cluster")
- .path("info").accept("application/xml")
- .get(ClientResponse.class);
- assertEquals("Should have received SAMEORIGIN x-frame options header",
- "SAMEORIGIN",
- response.getHeaders().get(XFrameOptionsFilter.X_FRAME_OPTIONS).get(0));
+ URL url = new URL("http://localhost:8088/ws/v1/cluster/info";);
+ HttpURLConnection conn = (HttpURLConnection) url.openConnection();
+ String xfoHeader = conn.getHeaderField("X-FRAME-OPTIONS");
+ Assert.assertNull("Unexpected X-FRAME-OPTION in header", xfoHeader);
}
@Test
- public void testExplicitlyDisabled() throws Exception {
- createInjector(null, true);
-
- WebResource r = resource();
- ClientResponse response = r.path("ws").path("v1").path("cluster")
- .path("info").accept("application/xml")
- .get(ClientResponse.class);
- assertFalse("Should have not received x-frame options header",
- response.getHeaders().get(XFrameOptionsFilter.X_FRAME_OPTIONS) ==
null);
+ public void testXFrameOptionsIllegalOption() {
+ IllegalArgumentException e = Assert.assertThrows(
+ IllegalArgumentException.class,
+ () -> createMockRm(true, "otherValue"));
}
+ @After
+ public void tearDown() throws IOException {
+ rm.close();
+ }
}
---------------------------------------------------------------------
To unsubscribe, e-mail: common-commits-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-commits-h...@hadoop.apache.org
