nishat-06 opened a new pull request, #8609:
URL: https://github.com/apache/hadoop/pull/8609

   ### Description of PR
   
   **Blob endpoint XML responses are parsed with external entities enabled**
   
   `parseBlockListResponse` creates its `DocumentBuilderFactory` via 
`newInstance()`, and the `saxParserThreadLocal` behind `parseListPathResults` 
and `parseListContainersResponse` does the same with `SAXParserFactory`. 
Neither disables DOCTYPE or external entity resolution, so XML coming back from 
the Blob endpoint on GetBlockList, ListBlobs and ListContainers is parsed with 
entity resolution on, and a response carrying `<!ENTITY xxe SYSTEM 
"file:///...">` has the entity resolved client side, with the contents landing 
in block ids and listing entries. Both now use the secure factories 
hadoop-common already exposes in `XMLUtils` for exactly this.
   
   I do not have a JIRA id for this yet, so the title does not carry one. Happy 
to file one and rename if you would like it tracked that way.
   
   ### How was this patch tested?
   
   New unit test `TestAbfsBlobClientXmlParsing` under hadoop-azure. It feeds 
`parseBlockListResponse` a block list response whose block name is an external 
entity pointing at a temp file: before the change the parse succeeds and hands 
back the file contents as a block id, after it the parse raises `IOException`. 
A second case parses a well formed block list and checks the ids still come 
through, so valid responses are unaffected.
   
   Ran locally on JDK 11:
   
   - `mvn test -pl hadoop-tools/hadoop-azure 
-Dtest='TestAbfsBlobClientXmlParsing,TestBlobListXmlParser,TestListActionTaker,TestAbfsClient,TestAbfsHttpOperation'`
 — 11 tests, all pass
   - `mvn install -DskipTests` from the root — BUILD SUCCESS
   - `mvn checkstyle:check -pl hadoop-tools/hadoop-azure` — nothing new on the 
two touched files
   
   The ABFS ITest suites need a live storage account, which I do not have, so 
they have not been run. That is the one gap I would ask a reviewer with an 
endpoint to cover.
   
   ### For code changes:
   
   - [ ] Does the title or this PR starts with the corresponding JIRA issue id 
(e.g. 'HADOOP-17799. Your PR title ...')?
   - [ ] Object storage: have the integration tests been executed and the 
endpoint declared according to the connector-specific documentation?
   - [ ] If adding new dependencies to the code, are these dependencies 
licensed in a way that is compatible for inclusion under [ASF 
2.0](http://www.apache.org/legal/resolved.html#category-a)?
   - [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`, 
`NOTICE-binary` files?
   
   No new dependencies; `XMLUtils` is already reachable from hadoop-azure 
through the hadoop-common provided dependency.
   
   ### AI Tooling
   
   If an AI tool was used:
   
   - [x] The PR includes the phrase "Contains content generated by <tool>"
         where <tool> is the name of the AI tool used.
   - [ ] My use of AI contributions follows the ASF legal policy
         https://www.apache.org/legal/generative-tooling.html
   
   Contains content generated by Claude Code.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to