Fixing issue with ZEPPELIN-173: Zeppelin websocket server is vulnerab…

[djoelz]

Fixing the socket cross-origin vulnerability as described in the Jira. Overwrote the checkOrigin in the WebSocketServlet class implemented by NotebookServer so that a list of all seen socket Get requests are kept and only Upgrade requests from the same origin will be accepted. Otherwise unauthorized will be returned.
Included basic unit tests.

[Leemoonsoo]

Could you explain little bit, why this if condition can be removed??

[djoelz]

I think it's a merge issue as I did not remove it. Let me double check

[djoelz]

Fixing in the next commit. Please review when you have time.

[Leemoonsoo]

Tested and working nicely. Thanks for the contribution!

[djoelz]

I have fixed the merge issues and recommitted. Ready for your review.

Thanks,
Joel

---

From: Lee moon soo notifications@github.com
Sent: Thursday, August 13, 2015 9:20:05 AM
To: apache/incubator-zeppelin
Cc: Joel Zambrano
Subject: Re: [incubator-zeppelin] Fixing issue with ZEPPELIN-173: Zeppelin websocket server is vulnerab… (#205)

Tested and working nicely. Thanks for the contribution!

—
Reply to this email directly or view it on GitHubhttps://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fgithub.com%2fapache%2fincubator-zeppelin%2fpull%2f205%23issuecomment-130748871&data=01%7c01%7cjoelz%40microsoft.com%7c8b71ee668dd34c8e280708d2a3fb0e00%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=ulufWnZiCgXfeRlodVWtuiUPUk0fi81urTN4V4uiJiA%3d.

[Leemoonsoo]

Thanks, LGTM.

[djoelz]

Great! Next step is to merge? Who does this?

[Leemoonsoo]

Next step is, getting more review and votes, or waiting for enough time to have discussions and consensus (which is normally take a day at least). Then it's going to be merged.

[philwills]

Not sure if it's best to comment here, or open a new issue, but

java.net.InetAddress.getLocalHost().getHostName();

isn't going to return all possible addresses which a node might reasonably be listening on. For instance, on an EC2 node, this will return the private IP, but if you want to connect to that node from outside of Amazon's network, that address won't be visible, where as the public address will.

I think there needs to at least be the option of setting an alternative value in config.

[corneadoug]

We got a similar problem, can't complete websocket handshake in some instalations since this commit

[Leemoonsoo]

@philwills@corneadoug Right, i'll create a patch, soon. Thanks!

[djoelz]

@Leemoonsoo can I suggest alternativeallowedsource as the configuration name? Also this will be used for my other pull request that affects REST endpoints as well.

I could implement it also if you want. have you started already?

[Leemoonsoo]

@djoelz If you can implement, that would be really appreciated!

[djoelz]

@Leemoonsoo@jonbuffington is already doing the work. I will work closely with Jon to wrap this up.

Thanks Jon!

[djoelz]

I have a fix for this. Will create the PR soon

[jitenderaswani]

Looking forward to this fix, I am unable to run Zeppelin in AWS. On my local machine, I don't have web-socket issue.

[Leemoonsoo]

@djoelz I also pushed a fix. @djoelz, @jitenderaswani please review #233.