[
https://issues.apache.org/jira/browse/KYLIN-6117?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123744#comment-18123744
]
ASF subversion and git services commented on KYLIN-6117:
--------------------------------------------------------
Commit dbf365d5a3da1ed589b30eb93d7dade43b4bc2a9 in kylin's branch
refs/heads/kylin5 from Li Yang
[ https://gitbox.apache.org/repos/asf?p=kylin.git;h=dbf365d5a3 ]
KYLIN-6117 require service token and confine backup_dir on metadata backup RPC
Gate the internal metadata-backup broadcast RPC endpoints behind a global
admin or a valid broadcast service token, attach the token on the internal
senders, and reject a caller-supplied backup_dir that is blank, contains a
path separator, or is '.'/'..' before any HDFS delete or write.
> Potential path traversal and missing authorization issue in metadata backup
> broadcast
> -------------------------------------------------------------------------------------
>
> Key: KYLIN-6117
> URL: https://issues.apache.org/jira/browse/KYLIN-6117
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Priority: Major
>
> Security issue reported for Apache Kylin 5.0.3. Public tracking issue only;
> technical details are being handled through the ASF security process.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
