[
https://issues.apache.org/jira/browse/HADOOP-8139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13226538#comment-13226538
]
Doug Cutting commented on HADOOP-8139:
--------------------------------------
> Do you have any idea what or where these may lurk...?
It's hard to know without testing on Windows. Maybe there won't be that any or
many. I find a number of places that call new Path(file.getCanonicalPath())
which might cause problems or might not, depending on what's done with the Path
returned.
> Path does not allow metachars to be escaped
> -------------------------------------------
>
> Key: HADOOP-8139
> URL: https://issues.apache.org/jira/browse/HADOOP-8139
> Project: Hadoop Common
> Issue Type: Bug
> Components: fs
> Affects Versions: 0.23.0, 0.24.0
> Reporter: Daryn Sharp
> Assignee: Daryn Sharp
> Priority: Blocker
> Attachments: HADOOP-8139-2.patch, HADOOP-8139-3.patch,
> HADOOP-8139.patch, HADOOP-8139.patch
>
>
> Path converts "\" into "/", probably for windows support? This means it's
> impossible for the user to escape metachars in a path name. Glob expansion
> can have deadly results.
> Here are the most egregious examples. A user accidentally creates a path like
> "/user/me/*/file". Now they want to remove it.
> {noformat}"hadoop fs -rmr -skipTrash '/user/me/\*'" becomes...
> "hadoop fs -rmr -skipTrash /user/me/*"{noformat}
> * User/Admin: Nuked their home directory or any given directory
> {noformat}"hadoop fs -rmr -skipTrash '\*'" becomes...
> "hadoop fs -rmr -skipTrash /*"{noformat}
> * User: Deleted _everything_ they have access to on the cluster
> * Admin: *Nukes the entire cluster*
> Note: FsShell is shown for illustrative purposes, however the problem is in
> the Path object, not FsShell.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
