liyang created KYLIN-6123:
-----------------------------
Summary: Potential cross-project access-control issue in job
profiling operations
Key: KYLIN-6123
URL: https://issues.apache.org/jira/browse/KYLIN-6123
Project: Kylin
Issue Type: Bug
Affects Versions: 5.0.5
Reporter: liyang
Assignee: liyang
Fix For: 5.0.6
Job profiling start and dump operations do not enforce project authorization.
The project-scoped variants accept an arbitrary project name, and the YARN
application variants resolve the owning project without checking the caller's
permission. An authenticated low-privilege user can start or retrieve profiling
data across projects.
Fix direction: enforce project operation permission in the service layer after
resolving the owning project, including both project and YARN application
lookup paths.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
