[ https://issues.apache.org/jira/browse/HIVE-22150?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16919444#comment-16919444 ]
Hive QA commented on HIVE-22150: -------------------------------- Here are the results of testing the latest attachment: https://issues.apache.org/jira/secure/attachment/12978932/HIVE-22150.patch.2 {color:green}SUCCESS:{color} +1 due to 4 test(s) being added or modified. {color:green}SUCCESS:{color} +1 due to 16745 tests passed Test results: https://builds.apache.org/job/PreCommit-HIVE-Build/18428/testReport Console output: https://builds.apache.org/job/PreCommit-HIVE-Build/18428/console Test logs: http://104.198.109.242/logs/PreCommit-HIVE-Build-18428/ Messages: {noformat} Executing org.apache.hive.ptest.execution.TestCheckPhase Executing org.apache.hive.ptest.execution.PrepPhase Executing org.apache.hive.ptest.execution.YetusPhase Executing org.apache.hive.ptest.execution.ExecutionPhase Executing org.apache.hive.ptest.execution.ReportingPhase {noformat} This message is automatically generated. ATTACHMENT ID: 12978932 - PreCommit-HIVE-Build > HS2 allows setting system properties > ------------------------------------ > > Key: HIVE-22150 > URL: https://issues.apache.org/jira/browse/HIVE-22150 > Project: Hive > Issue Type: Bug > Components: HiveServer2 > Affects Versions: 3.1.1 > Reporter: Craig Condit > Assignee: Hui An > Priority: Major > Attachments: HIVE-22150.patch.1, HIVE-22150.patch.2 > > > HiveServer2 currently allows setting system properties, which is a problem > when used in a multi-user environment. > Connecting via beeline and executing the following demonstrates the issue: > {noformat} > 0: jdbc:hive2://serv1000.example.com:2181,serv> SET system:java.io.tmpdir; > +-----------------------------+ > | set | > +-----------------------------+ > | system:java.io.tmpdir=/tmp | > +-----------------------------+ > 1 row selected (0.018 seconds) > 0: jdbc:hive2://serv1000.example.com:2181,serv> SET > system:java.io.tmpdir=/tmp/attacker-dir; > No rows affected (0.013 seconds) > 0: jdbc:hive2://serv1000.example.com:2181,serv> SET system:java.io.tmpdir; > +------------------------------------------+ > | set | > +------------------------------------------+ > | system:java.io.tmpdir=/tmp/attacker-dir | > +------------------------------------------+ > 1 row selected (0.019 seconds) > {noformat} > Any changes persist until HS2 is restarted, and affect all connected users. > At the very least, this is a denial-of-service vector (verified by setting > line.separator to a random string). -- This message was sent by Atlassian Jira (v8.3.2#803003)