hbase-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bus...@apache.org
Subject [1/6] hbase git commit: Revert "HBase Thrift HTTP - Shouldn't handle TRACE/OPTIONS methods"
Date Sat, 21 Apr 2018 03:46:20 GMT
Repository: hbase
Updated Branches:
  refs/heads/branch-1 fe84833ea -> e60189035
  refs/heads/branch-2 298ce9624 -> cb1aaa683
  refs/heads/branch-2.0 0b4f3d1f5 -> 51069e6e8


Revert "HBase Thrift HTTP - Shouldn't handle TRACE/OPTIONS methods"

This reverts commit 05f8e94191ef6a63baadf56d6114d7d0317796f2.

missing jira key


Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/1546613e
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/1546613e
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/1546613e

Branch: refs/heads/branch-2
Commit: 1546613e76b1013a08ebc179c2c22bfeb44f3a4a
Parents: 298ce96
Author: Sean Busbey <busbey@apache.org>
Authored: Fri Apr 20 22:43:25 2018 -0500
Committer: Sean Busbey <busbey@apache.org>
Committed: Fri Apr 20 22:43:56 2018 -0500

----------------------------------------------------------------------
 .../hadoop/hbase/http/TestHttpServer.java       | 13 ++----------
 .../hadoop/hbase/thrift/ThriftServerRunner.java |  2 --
 .../hbase/thrift/TestThriftHttpServer.java      | 21 ++++----------------
 3 files changed, 6 insertions(+), 30 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/hbase/blob/1546613e/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java
----------------------------------------------------------------------
diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java
index 10553da..16350d5 100644
--- a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java
+++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java
@@ -605,6 +605,8 @@ public class TestHttpServer extends HttpServerFunctionalTest {
     myServer.stop();
   }
 
+
+
   @Test
   public void testNoCacheHeader() throws Exception {
     URL url = new URL(baseUrl, "/echo?a=b&c=d");
@@ -617,15 +619,4 @@ public class TestHttpServer extends HttpServerFunctionalTest {
     assertEquals(conn.getHeaderField("Expires"), conn.getHeaderField("Date"));
     assertEquals("DENY", conn.getHeaderField("X-Frame-Options"));
   }
-
-  @Test
-  public void testHttpMethods() throws Exception {
-    // HTTP TRACE method should be disabled for security
-    // See https://www.owasp.org/index.php/Cross_Site_Tracing
-    URL url = new URL(baseUrl, "/echo?a=b");
-    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
-    conn.setRequestMethod("TRACE");
-    conn.connect();
-    assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
-  }
 }

http://git-wip-us.apache.org/repos/asf/hbase/blob/1546613e/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
----------------------------------------------------------------------
diff --git a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
index 5d887f9..16894ad 100644
--- a/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
+++ b/hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift/ThriftServerRunner.java
@@ -79,7 +79,6 @@ import org.apache.hadoop.hbase.filter.Filter;
 import org.apache.hadoop.hbase.filter.ParseFilter;
 import org.apache.hadoop.hbase.filter.PrefixFilter;
 import org.apache.hadoop.hbase.filter.WhileMatchFilter;
-import org.apache.hadoop.hbase.http.HttpServerUtil;
 import org.apache.hadoop.hbase.log.HBaseMarkers;
 import org.apache.hadoop.hbase.security.SaslUtil;
 import org.apache.hadoop.hbase.security.SaslUtil.QualityOfProtection;
@@ -446,7 +445,6 @@ public class ThriftServerRunner implements Runnable {
     // Context handler
     ServletContextHandler ctxHandler = new ServletContextHandler(httpServer, "/", ServletContextHandler.SESSIONS);
     ctxHandler.addServlet(new ServletHolder(thriftHttpServlet), "/*");
-    HttpServerUtil.constrainHttpMethods(ctxHandler);
 
     // set up Jetty and run the embedded server
     HttpConfiguration httpConfig = new HttpConfiguration();

http://git-wip-us.apache.org/repos/asf/hbase/blob/1546613e/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
----------------------------------------------------------------------
diff --git a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
index c3fecf6..bd156bc 100644
--- a/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
+++ b/hbase-thrift/src/test/java/org/apache/hadoop/hbase/thrift/TestThriftHttpServer.java
@@ -21,8 +21,6 @@ import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.fail;
 
-import java.net.HttpURLConnection;
-import java.net.URL;
 import java.util.ArrayList;
 import java.util.List;
 import org.apache.hadoop.conf.Configuration;
@@ -40,7 +38,6 @@ import org.apache.thrift.protocol.TProtocol;
 import org.apache.thrift.transport.THttpClient;
 import org.apache.thrift.transport.TTransportException;
 import org.junit.AfterClass;
-import org.junit.Assert;
 import org.junit.BeforeClass;
 import org.junit.ClassRule;
 import org.junit.Rule;
@@ -174,10 +171,8 @@ public class TestThriftHttpServer {
       Thread.sleep(100);
     }
 
-    String url = "http://"+ HConstants.LOCALHOST + ":" + port;
     try {
-      checkHttpMethods(url);
-      talkToThriftServer(url, customHeaderSize);
+      talkToThriftServer(customHeaderSize);
     } catch (Exception ex) {
       clientSideException = ex;
     } finally {
@@ -194,19 +189,11 @@ public class TestThriftHttpServer {
     }
   }
 
-  private void checkHttpMethods(String url) throws Exception {
-    // HTTP TRACE method should be disabled for security
-    // See https://www.owasp.org/index.php/Cross_Site_Tracing
-    HttpURLConnection conn = (HttpURLConnection) new URL(url).openConnection();
-    conn.setRequestMethod("TRACE");
-    conn.connect();
-    Assert.assertEquals(HttpURLConnection.HTTP_FORBIDDEN, conn.getResponseCode());
-  }
-
   private static volatile boolean tableCreated = false;
 
-  private void talkToThriftServer(String url, int customHeaderSize) throws Exception {
-    THttpClient httpClient = new THttpClient(url);
+  private void talkToThriftServer(int customHeaderSize) throws Exception {
+    THttpClient httpClient = new THttpClient(
+        "http://"+ HConstants.LOCALHOST + ":" + port);
     httpClient.open();
 
     if (customHeaderSize > 0) {


Mime
View raw message