Skip to content

HBASE-28514: HBase web console automatically listing directories in static/css - #5830

Open
Kota-SH wants to merge 1 commit into
apache:masterfrom
Kota-SH:HBASE-28514
Open

HBASE-28514: HBase web console automatically listing directories in static/css#5830
Kota-SH wants to merge 1 commit into
apache:masterfrom
Kota-SH:HBASE-28514

Conversation

@Kota-SH

@Kota-SHKota-SH commented Apr 15, 2024

Copy link
Copy Markdown
Contributor

@Apache-HBase

Apache-HBase commented Apr 15, 2024

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 35sDocker mode activated.
_ Prechecks _
+1 💚dupname0m 0sNo case conflicting files found.
+1 💚hbaseanti0m 0sPatch does not have any anti-patterns.
+1 💚@author0m 0sThe patch does not contain any @author tags.
_ master Compile Tests _
+0 🆗mvndep0m 11sMaven dependency ordering for branch
+1 💚mvninstall3m 1smaster passed
+1 💚compile3m 7smaster passed
+1 💚checkstyle0m 57smaster passed
+1 💚spotless0m 44sbranch has no errors when running spotless:check.
+1 💚spotbugs1m 57smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 11sMaven dependency ordering for patch
+1 💚mvninstall2m 49sthe patch passed
+1 💚compile3m 7sthe patch passed
+1 💚javac3m 7sthe patch passed
-0 ⚠️checkstyle0m 10shbase-http: The patch generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚whitespace0m 0sThe patch has no whitespace issues.
+1 💚xml0m 1sThe patch has no ill-formed XML file.
+1 💚hadoopcheck4m 54sPatch does not cause any errors with Hadoop 3.3.6.
-1 ❌spotless0m 21spatch has 21 errors when running spotless:check, run spotless:apply to fix.
+1 💚spotbugs2m 14sthe patch passed
_ Other Tests _
+1 💚asflicense0m 30sThe patch does not generate ASF License warnings.
32m 2s
SubsystemReport/Notes
DockerClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsdupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile xml
unameLinux bf5affe5fc9a 5.4.0-176-generic #196-Ubuntu SMP Fri Mar 22 16:46:39 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4b7a39a
Default JavaEclipse Adoptium-11.0.17+8
checkstylehttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/diff-checkstyle-hbase-http.txt
spotlesshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count79 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versionsgit=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Apr 15, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 13sDocker mode activated.
-0 ⚠️yetus0m 3sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for branch
+1 💚mvninstall2m 59smaster passed
+1 💚compile1m 27smaster passed
+1 💚shadedjars5m 15sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 53smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 11sMaven dependency ordering for patch
+1 💚mvninstall2m 47sthe patch passed
+1 💚compile1m 30sthe patch passed
+1 💚javac1m 30sthe patch passed
+1 💚shadedjars5m 12spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 52sthe patch passed
_ Other Tests _
+1 💚unit0m 55shbase-http in the patch passed.
+1 💚unit216m 41shbase-server in the patch passed.
+1 💚unit0m 29shbase-shaded-testing-util in the patch passed.
244m 21s
SubsystemReport/Notes
DockerClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 720bd85eab5d 5.4.0-172-generic #190-Ubuntu SMP Fri Feb 2 23:24:22 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4b7a39a
Default JavaEclipse Adoptium-17.0.10+7
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count5404 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Apr 15, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 39sDocker mode activated.
-0 ⚠️yetus0m 2sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 15sMaven dependency ordering for branch
+1 💚mvninstall4m 1smaster passed
+1 💚compile1m 41smaster passed
+1 💚shadedjars8m 30sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc1m 6smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 11sMaven dependency ordering for patch
+1 💚mvninstall3m 23sthe patch passed
+1 💚compile1m 43sthe patch passed
+1 💚javac1m 43sthe patch passed
+1 💚shadedjars5m 37spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 41sthe patch passed
_ Other Tests _
+1 💚unit0m 47shbase-http in the patch passed.
+1 💚unit224m 3shbase-server in the patch passed.
+1 💚unit0m 22shbase-shaded-testing-util in the patch passed.
257m 8s
SubsystemReport/Notes
DockerClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 8cb251143571 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4b7a39a
Default JavaTemurin-1.8.0_352-b08
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count5431 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Apr 15, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec1m 10sDocker mode activated.
-0 ⚠️yetus0m 2sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for branch
+1 💚mvninstall3m 15smaster passed
+1 💚compile1m 49smaster passed
+1 💚shadedjars6m 45sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 54smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for patch
+1 💚mvninstall3m 20sthe patch passed
+1 💚compile1m 42sthe patch passed
+1 💚javac1m 42sthe patch passed
+1 💚shadedjars6m 47spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 48sthe patch passed
_ Other Tests _
+1 💚unit1m 0shbase-http in the patch passed.
+1 💚unit245m 25shbase-server in the patch passed.
+1 💚unit1m 6shbase-shaded-testing-util in the patch passed.
278m 53s
SubsystemReport/Notes
DockerClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 3d219434a9dc 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 4b7a39a
Default JavaEclipse Adoptium-11.0.17+8
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count4508 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache9

Apache9 commented Apr 21, 2024

Copy link
Copy Markdown
Contributor

Mind explaining a bit?

Thanks.

@stoty

stoty commented Apr 24, 2024

Copy link
Copy Markdown
Contributor

The changes look OK.

My concern is whether this breaks existing functionality.
IIRC there are some screens where the UI lets you download files.
Won't those be broken by this change ?

@Kota-SH

Kota-SH commented Apr 24, 2024

Copy link
Copy Markdown
ContributorAuthor

Mind explaining a bit?

Thanks.

@Apache9 Thanks for the review!
So the issue is that the HBase UI automatically lists the contents of the /static directory when called explicitly by appending the HBase master URL with '/static'. For example- https://hbase-master:22002/static/
This could be a security concern.
This patch adds an index file in the /static so that the directories are not listed and the URL is redirected to the master UI home.

@Kota-SH

Kota-SH commented Apr 24, 2024

Copy link
Copy Markdown
ContributorAuthor

The changes look OK.

My concern is whether this breaks existing functionality. IIRC there are some screens where the UI lets you download files. Won't those be broken by this change ?

@stoty Thanks for the review.
We are only adding the index file to the static directory and changing the static context to admin-authorized servlet.
AFAIU, this doesn't affect other screens.
Please let me know if there is anything I'm missing here.

stoty
stoty reviewed Apr 24, 2024
View reviewed changes
Comment thread...il/src/main/resources/org/apache/hadoop/hbase/shaded/org/eclipse/jetty/webapp/webdefault.xml Outdated
<init-param>
<param-name>dirAllowed</param-name>
<param-value>true</param-value>
<param-value>false</param-value>

@stotystotyApr 24, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a general default setting to me, @Kota-SH .

@Apache-HBase

Apache-HBase commented Jun 5, 2024

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 0sDocker mode activated.
-1 ❌docker0m 1sDocker failed to build yetus/hbase:8a715fadd5.
SubsystemReport/Notes
GITHUB PR#5830
JIRA IssueHBASE-28514
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versionsgit=2.17.1
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Jun 5, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 11sDocker mode activated.
-0 ⚠️yetus0m 3sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 11sMaven dependency ordering for branch
+1 💚mvninstall2m 52smaster passed
+1 💚compile1m 27smaster passed
+1 💚shadedjars5m 13sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 53smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for patch
+1 💚mvninstall2m 48sthe patch passed
+1 💚compile1m 28sthe patch passed
+1 💚javac1m 28sthe patch passed
+1 💚shadedjars5m 9spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 52sthe patch passed
_ Other Tests _
+1 💚unit0m 55shbase-http in the patch passed.
+1 💚unit216m 7shbase-server in the patch passed.
+1 💚unit0m 32shbase-shaded-testing-util in the patch passed.
243m 44s
SubsystemReport/Notes
DockerClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 4587204f7b80 5.4.0-182-generic #202-Ubuntu SMP Fri Apr 26 12:29:36 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8afd93e
Default JavaEclipse Adoptium-17.0.10+7
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count4802 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Jun 5, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 30sDocker mode activated.
-0 ⚠️yetus0m 2sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 18sMaven dependency ordering for branch
+1 💚mvninstall2m 42smaster passed
+1 💚compile1m 5smaster passed
+1 💚shadedjars5m 40sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 44smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for patch
+1 💚mvninstall2m 23sthe patch passed
+1 💚compile1m 10sthe patch passed
+1 💚javac1m 10sthe patch passed
+1 💚shadedjars5m 40spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 42sthe patch passed
_ Other Tests _
+1 💚unit0m 47shbase-http in the patch passed.
+1 💚unit227m 16shbase-server in the patch passed.
+1 💚unit0m 21shbase-shaded-testing-util in the patch passed.
253m 47s
SubsystemReport/Notes
DockerClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux f0475d19b861 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8afd93e
Default JavaTemurin-1.8.0_352-b08
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count5158 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Apache-HBase commented Jun 5, 2024

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec0m 42sDocker mode activated.
-0 ⚠️yetus0m 2sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+0 🆗mvndep0m 14sMaven dependency ordering for branch
+1 💚mvninstall3m 14smaster passed
+1 💚compile1m 51smaster passed
+1 💚shadedjars7m 8sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 50smaster passed
_ Patch Compile Tests _
+0 🆗mvndep0m 12sMaven dependency ordering for patch
+1 💚mvninstall3m 35sthe patch passed
+1 💚compile1m 33sthe patch passed
+1 💚javac1m 33sthe patch passed
+1 💚shadedjars7m 28spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc0m 55sthe patch passed
_ Other Tests _
+1 💚unit1m 18shbase-http in the patch passed.
+1 💚unit251m 10shbase-server in the patch passed.
+1 💚unit0m 43shbase-shaded-testing-util in the patch passed.
285m 30s
SubsystemReport/Notes
DockerClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR#5830
JIRA IssueHBASE-28514
Optional Testsjavac javadoc unit shadedjars compile
unameLinux f53ae3b56e37 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8afd93e
Default JavaEclipse Adoptium-11.0.17+8
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count4487 (vs. ulimit of 30000)
modulesC: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versionsgit=2.34.1 maven=3.8.6
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

stoty
stoty reviewed Jun 6, 2024
View reviewed changes
Comment threadhbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
ServletContextHandler staticContext = new ServletContextHandler(parent, "/static");
staticContext.setResourceBase(appDir + "/static");
staticContext.addServlet(DefaultServlet.class, "/*");
staticContext.addServlet(AdminAuthorizedServlet.class, "/*");

@stotystotyJun 6, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does AdminAuthorizedServlet do ?

We don't want to limit the static folder to admin users.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@petersomogyipetersomogyiAwaiting requested review from petersomogyi
@wchevreuilwchevreuilAwaiting requested review from wchevreuil
1 more reviewer
@stotystotystoty left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Kota-SH@Apache-HBase@Apache9@stoty@shankot