bamaer opened a new issue, #8371: URL: https://github.com/apache/hop/issues/8371
### What needs to happen? All 30 servlets in `org.apache.hop.www` handle `doGet`, and state-changing operations are reachable that way — including pipeline execution. No servlet checks `Origin`, `Referer`, a token, or anything else that distinguishes a request made by the operator from one made by a page the operator happens to be visiting. `ExecPipelineServlet` takes the pipeline path from a request parameter (`ExecPipelineServlet.java:98`), resolves variables in it (`:134`) and loads it through VFS (`:147`), so remote schemes such as `http://` are accepted as the source of the pipeline to run. ## Proposed change Install one servlet filter centrally and key it on `Sec-Fetch-Site`, rejecting `cross-site`. `Origin` is not a workable basis here: browsers omit it on cross-site GET, which is exactly the shape these endpoints expose. `Sec-Fetch-Site` is sent on those requests, and non-browser clients (hop-run, the Hop GUI, curl, customer automation) send no `Sec-Fetch-*` headers at all, so treating an absent header as "allow" leaves existing integrations untouched. `WebServer.createContexts()` registers every servlet in one loop (`WebServer.java:245`), and `innerHandler` wraps the lot — note it is assigned in two branches, `:198` with authentication enabled and `:205` without, so both need to be covered. Moving the state-changing operations to POST would be the more conventional fix, but it means changing all 30 servlets and breaking every existing client, so it is not proposed here. ## Second, separable change Constrain the pipeline path in `ExecPipelineServlet` so a pipeline is not fetched from an arbitrary remote VFS location. This is independent of the filter and could be its own issue if preferred; a configuration option would be needed for deployments that legitimately load pipelines from remote VFS. ## Compatibility The filter's policy needs a decision: whether `same-site` is allowed alongside `same-origin`, and how navigations are treated. Requires testing against the Hop GUI's own server calls, hop-run, and typical automation. The code is small; the verification is the bulk of the work. ### Issue Priority Priority: 2 ### Issue Component Component: Hop Server -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
