Elek, Marton created ZEPPELIN-2288:
--------------------------------------
Summary: Fix Cross-Site WebSocket check
Key: ZEPPELIN-2288
URL: https://issues.apache.org/jira/browse/ZEPPELIN-2288
Project: Zeppelin
Issue Type: Bug
Components: Core
Affects Versions: 0.7.0
Reporter: Elek, Marton
The websocket cross site vulnerability check implemented in ZEPPELIN-173 has
been broken by the ZEPPELIN-798 (migrate to jetty9). The checkOrigin has no
longer an overridden method, so it won't be called.
see:
http://download.eclipse.org/jetty/8.1.17.v20150415/apidocs//org/eclipse/jetty/websocket/WebSocketServlet.html
http://www.eclipse.org/external/jetty/stable-9/apidocs/org/eclipse/jetty/websocket/servlet/WebSocketServlet.html
The second one doesn't contain the checkOrigin.
A trivial fix is to call the existing check from the WebsocketCreator.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
