mattcasters commented on PR #8287: URL: https://github.com/apache/hop/pull/8287#issuecomment-5615658376
### Follow-up Review: Security & Integrity Recommendations Addressed in `bdcae03` Commit `bdcae03ada` cleanly addresses all 6 items identified in the review: 1. **GZIP Stream Integrity (`GzipCompressionInputStream`):** Removed the `EOFException` catch block that masked truncated streams. Truncated gzip files now fail fast and preserve CRC32 validation (`truncatedGzipFailsInsteadOfSilentSuccess`). 2. **SPNEGO Protection on Writes (`HdfsWebHdfsClient`):** `putStream` now guards `addSpnego` with `shouldSpnegoForLocation(uri)`. Kerberos service tickets are no longer minted or sent to DataNode URLs. 3. **Keystore Password Decryption (`HdfsTls`):** Wrapped `meta.getTruststorePassword()` with `Encr.decryptPasswordOptionallyEncrypted(...)`, ensuring saved/encrypted truststore passwords load correctly. 4. **HTTPS Downgrade Protection:** Added `rejectHttpDowngrade()` to prevent silent redirects to unencrypted HTTP DataNodes on HTTPS connections, along with an opt-in `allowHttpDatanodeRedirects` setting (default: off) for legacy clusters. 5. **JVM Kerberos Serialization (`HdfsKerberosSession`):** Synchronized Kerberos configuration and login around `JVM_KERBEROS` to prevent concurrency races in multi-connection/server environments; avoided clobbering Realm/KDC when `krb5.conf` is provided. 6. **Session & HTTP Client Lifecycle:** Added `unregister()` to `HdfsKerberosRenewer` and lifecycle cleanup in `session.close()`, `HdfsConnectionTester`, and `HdfsFileSystem.doCloseCommunicationLink()`, closing both `kerberosSession` and `httpClient` to prevent leaks. All unit tests pass and Spotless formatting is clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
