[
https://issues.apache.org/jira/browse/HIVE-23704?focusedWorklogId=447429&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-447429
]
ASF GitHub Bot logged work on HIVE-23704:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 17/Jun/20 17:49
Start Date: 17/Jun/20 17:49
Worklog Time Spent: 10m
Work Description: belugabehr commented on pull request #1127:
URL: https://github.com/apache/hive/pull/1127#issuecomment-645524894
Existing code works because Commons Digest Base64 implementation ignores
invalid characters:.
https://github.com/apache/commons-codec/blob/41c6f486fd4f5c2450c9311c40dbbf7e576d2907/src/main/java/org/apache/commons/codec/binary/Base64.java#L640
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 447429)
Time Spent: 40m (was: 0.5h)
> Thrift HTTP Server Does Not Handle Auth Handle Correctly
> --------------------------------------------------------
>
> Key: HIVE-23704
> URL: https://issues.apache.org/jira/browse/HIVE-23704
> Project: Hive
> Issue Type: Bug
> Components: Security
> Affects Versions: 3.1.2, 2.3.7
> Reporter: David Mollitor
> Assignee: David Mollitor
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.0.0
>
> Attachments: Base64NegotiationError.png
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> {code:java|title=ThriftHttpServlet.java}
> private String[] getAuthHeaderTokens(HttpServletRequest request,
> String authType) throws HttpAuthenticationException {
> String authHeaderBase64 = getAuthHeader(request, authType);
> String authHeaderString = StringUtils.newStringUtf8(
> Base64.decodeBase64(authHeaderBase64.getBytes()));
> String[] creds = authHeaderString.split(":");
> return creds;
> }
> {code}
> So here, it takes the authHeaderBase64 (which is a base-64 string), and
> converts it into bytes, and then it tries to decode those bytes. That is
> incorrect It should covert base-64 string directly into bytes.
> I tried to do this as part of [HIVE-22676] and the tests was failing because
> the string that is being decoded is not actually Base-64 (see attached image)
> It has a stray space and a colon. Again, the existing code doesn't care
> because it's not parsing Base-64 text, it is parsing the bytes generated by
> converting base-64 text to bytes.
> I'm not sure what affect this has, what security issues this may present, but
> it's definitely not correct.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
