bamaer opened a new issue, #8373:
URL: https://github.com/apache/hop/issues/8373
### What needs to happen?
Split out of #8371, which covers the cross-site filter only.
`ExecPipelineServlet` takes the pipeline path from a request parameter
(`ExecPipelineServlet.java:98`), resolves variables in it (`:134`) and loads
it
through VFS (`:147`). Remote schemes such as `http://` are therefore
accepted as
the source of the pipeline to run: an authenticated caller can point the
server
at a pipeline hosted anywhere and have it executed with the server's full
host
capability.
#8371 installed a `Sec-Fetch-Site` filter, which stops a browser being used
to
reach this endpoint on an operator's behalf. It does nothing about a client
that
reaches the server directly, which is the case here.
## Proposed change
Constrain where `ExecPipelineServlet` may load a pipeline from — by default,
local and project-relative locations only, rejecting remote VFS schemes.
A configuration option is needed for deployments that legitimately load
pipelines from remote VFS (an `hdfs://`, `s3://` or `gs://` project store is
a
normal setup), so this cannot be a flat prohibition. Worth deciding as part
of
the work:
- whether the option is a scheme allow-list or a simple on/off,
- whether it also covers `ExecWorkflowServlet`, which has the same shape,
- how it interacts with the `HOP_SERVER_*` / hop-server CLI option style used
for `--cross-site-policy` in #8371.
## Notes
Per the threat model, running an untrusted `.hpl`/`.hwf` is equivalent to
executing untrusted instructions and there is no signature or provenance
check
on those files, so narrowing where the server will fetch one from is
worthwhile
even though pipeline authorship itself stays a trusted input.
### Issue Priority
Priority: 2
### Issue Component
Component: Hop Server
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
