[HADOOP-19079] HttpExceptionUtils to check that loaded class is really an exception before instantiation

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.3.9, 3.5.0, 3.4.1
• Component/s: common, security
• Labels: pull-request-available
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 16/Feb/24 02:11
• Updated: 11/Apr/24 18:49
• Resolved: 11/Apr/24 18:47

Description

It can be dangerous taking class names as inputs from HTTP messages even if we control the source. Issue is in HttpExceptionUtils in hadoop-common (validateResponse method).

I can provide a PR that will highlight the issue.

Issue Links

• links to: GitHub Pull Request #6557