Skip to content

[Minor] Remove hardcoded key in zeppelinhub. - #2621

Closed
yanboliang wants to merge 1 commit into
apache:masterfrom
yanboliang:key
Closed

[Minor] Remove hardcoded key in zeppelinhub.#2621
yanboliang wants to merge 1 commit into
apache:masterfrom
yanboliang:key

Conversation

@yanboliang

@yanboliangyanboliang commented Oct 11, 2017•
edited
Loading

Copy link
Copy Markdown
Contributor

What is this PR for?

Hardcoded seed/key may cause security issue, so remove potential risk.

What type of PR is it?

[Improvement]

Todos

No.

What is the Jira issue?

No jira created.

@yanboliang

yanboliang commented Oct 11, 2017

Copy link
Copy Markdown
ContributorAuthor

@prabhjyotsingh Please help review.

@yanboliangyanboliang reopened this Oct 12, 2017
prabhjyotsingh
prabhjyotsingh approved these changes Oct 12, 2017
View reviewed changes

@prabhjyotsinghprabhjyotsingh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, there shouldn't be any hard-coded KEY.

@khalidhuseynov

khalidhuseynov commented Oct 12, 2017

Copy link
Copy Markdown
Member

LGTM

@felixcheung

felixcheung commented Oct 12, 2017

Copy link
Copy Markdown
Member

@Leemoonsoo

@krishna-pandey

krishna-pandey commented Oct 12, 2017

Copy link
Copy Markdown
Contributor

We need to consider below while removing the key. Are we relying on any such behaviour by specifying the seed value?
"If two instances of Random are created with the same seed, and the same sequence of method calls is made for each, they will generate and return identical sequences of numbers."

Refer: http://docs.oracle.com/javase/8/docs/api/java/util/Random.html

@krishna-pandey

krishna-pandey commented Oct 12, 2017

Copy link
Copy Markdown
Contributor

LGTM.
It seems we are using SecureRandom which does not require seed explicitly to initialise and hence hardcoded key can be removed, unless we intentionally wanted a deterministic output.

@yanboliangyanboliang reopened this Oct 12, 2017
@prabhjyotsingh

prabhjyotsingh commented Oct 13, 2017•
edited
Loading

Copy link
Copy Markdown
Contributor

Merging this if no more discussion.

Build fails for profile #4(selenium, https://travis-ci.org/yanboliang/zeppelin/jobs/286776182) which looks flaky and unrelated to me.

@yanboliang
yanboliang deleted the key branch October 16, 2017 23:46
prabhjyotsingh pushed a commit to prabhjyotsingh/zeppelin that referenced this pull request Oct 23, 2017
@yanboliang@prabhjyotsingh
BUG-82571: [Minor] Remove hardcoded key in zeppelinhub.
fa4079d
Hardcoded seed/key may cause security issue, so remove potential risk.
[Improvement]
No.
No jira created.
Author: Yanbo Liang <ybliang8@gmail.com>
Closesapache#2621 from yanboliang/key and squashes the following commits:
2515283 [Yanbo Liang] Remove hardcoded key in zeppelinhub.
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prabhjyotsinghprabhjyotsinghprabhjyotsingh approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@yanboliang@khalidhuseynov@felixcheung@krishna-pandey@prabhjyotsingh