Skip to content

check port in PutAction to avoid SSRF(Server-Side Request Forgery) #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
morningman merged 1 commit into from
Sep 13, 2017
Merged

check port in PutAction to avoid SSRF(Server-Side Request Forgery) #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion fe/src/com/baidu/palo/http/BaseAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,13 @@ public void setQeService(QeService qeService) {
public void handleRequest(BaseRequest request) throws Exception {
BaseResponse response = new BaseResponse();
LOG.debug("receive http request. url={}", request.getRequest().uri());
execute(request, response);
try {
execute(request, response);
} catch (Exception e) {
LOG.warn("fail to process url={}. error={}",
request.getRequest().uri(), e);
writeResponse(request, response, HttpResponseStatus.NOT_FOUND);
}
}

public abstract void execute(BaseRequest request, BaseResponse response) throws DdlException;
Expand Down
56 changes: 35 additions & 21 deletions fe/src/com/baidu/palo/http/meta/MetaService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,18 +28,19 @@
import com.baidu.palo.persist.Storage;
import com.baidu.palo.persist.StorageInfo;
import com.baidu.palo.system.Frontend;

import com.google.common.base.Preconditions;
import com.google.common.base.Strings;
import com.google.common.collect.Maps;
import com.google.gson.Gson;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import io.netty.handler.codec.http.HttpHeaders;
import io.netty.handler.codec.http.HttpMethod;
import io.netty.handler.codec.http.HttpResponseStatus;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
Expand Down Expand Up @@ -179,8 +180,21 @@ public void executeGet(BaseRequest request, BaseResponse response) {
if (!Strings.isNullOrEmpty(strVersion)) {
long version = Long.parseLong(strVersion);
String machine = request.getHostString();
String port = request.getSingleParameter(PORT);
String url = "http://" + machine + ":" + port + "/image?version=" + version;
String portParam = request.getSingleParameter(PORT);
// check port to avoid SSRF(Server-Side Request Forgery)
if (Strings.isNullOrEmpty(portParam)) {
LOG.warn("port is not provided.");
writeResponse(request, response, HttpResponseStatus.NOT_FOUND);
}
{
int port = Integer.parseInt(portParam);
if (port < 0 || port > 65535) {
LOG.warn("port is invalid. port={}", port);
writeResponse(request, response, HttpResponseStatus.NOT_FOUND);
}
}
String url = "http://" + machine + ":" + portParam + "/image?version=" + version;
LOG.debug("generated image url={}", url);
String filename = Storage.IMAGE + "." + version;
try {
OutputStream out = MetaHelper.getOutputStream(filename, dir);
Expand Down Expand Up @@ -229,11 +243,11 @@ public void executeGet(BaseRequest request, BaseResponse response) {
writeResponse(request, response);
}
}

public static class RoleAction extends MetaBaseAction {
private static final String HOST = "host";
private static final String PORT = "port";

public RoleAction(ActionController controller, File imageDir) {
super(controller, imageDir);
}
Expand Down Expand Up @@ -274,17 +288,17 @@ public void executeGet(BaseRequest request, BaseResponse response) {
*/
public static class CheckAction extends MetaBaseAction {
private static final Logger LOG = LogManager.getLogger(CheckAction.class);

public CheckAction(ActionController controller, File imageDir) {
super(controller, imageDir);
}
public static void registerAction (ActionController controller, File imageDir)

public static void registerAction (ActionController controller, File imageDir)
throws IllegalArgException {
controller.registerHandler(HttpMethod.GET, "/check",
controller.registerHandler(HttpMethod.GET, "/check",
new CheckAction(controller, imageDir));
}

@Override
public void executeGet(BaseRequest request, BaseResponse response) {
try {
Expand All @@ -295,12 +309,12 @@ public void executeGet(BaseRequest request, BaseResponse response) {
LOG.error(e);
}
writeResponse(request, response);
}
}
}

public static class DumpAction extends MetaBaseAction {
private static final Logger LOG = LogManager.getLogger(CheckAction.class);

public DumpAction(ActionController controller, File imageDir) {
super(controller, imageDir);
}
Expand All @@ -322,7 +336,7 @@ public void executeGet(BaseRequest request, BaseResponse response) {
* the jobs' read lock. This will guarantee the consistance of database and job queues.
* But Backend may still inconsistent.
*/

// TODO: Still need to lock ClusterInfoService to prevent add or drop Backends
LOG.info("begin to dump meta data.");
Catalog catalog = Catalog.getInstance();
Expand All @@ -348,11 +362,11 @@ public void executeGet(BaseRequest request, BaseResponse response) {
db.readLock();
}
LOG.info("acquired all the dbs' read lock.");

catalog.getAlterInstance().getRollupHandler().readLock();
catalog.getAlterInstance().getSchemaChangeHandler().readLock();
catalog.getLoadInstance().readLock();

LOG.info("acquired all jobs' read lock.");
long journalId = catalog.getMaxJournalId();
File dumpFile = new File(Config.meta_dir, "image." + journalId);
Expand All @@ -363,7 +377,7 @@ public void executeGet(BaseRequest request, BaseResponse response) {
} catch (IOException e) {
LOG.error(e);
}

} finally {
// unlock all

Expand All @@ -377,9 +391,9 @@ public void executeGet(BaseRequest request, BaseResponse response) {

catalog.readUnlock();
}

LOG.info("dump finished.");

response.appendContent("dump finished. " + dumpFilePath);
writeResponse(request, response);
return;
Expand Down