Uploaded image for project: 'HBase'
  1. HBase
  2. HBASE-21275

Thrift Server (branch 1 fix) -> Disable TRACE HTTP method for thrift http server (branch 1 only)

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 1.3.3, 1.4.9
    • Component/s: Thrift
    • Labels:
      None
    • Hadoop Flags:
      Reviewed
    • Flags:
      Patch

      Description

      There's been a reasonable number of users running thrift http server on hbase 1.x suffering with security audit tests pointing thrift server allows TRACE requests.

      After doing some search, I can see HBASE-20406 added restrictions for TRACE/OPTIONS method when Thrift is running over http, but it relies on many other commits applied to thrift http server. This patch was later reverted from master. Then again later, HBASE-20004 had made TRACE/OPTIONS configurable via "hbase.thrift.http.allow.options.method" property, with both methods being disabled by default. This also seems to rely on many changes applied to thrift http server, and a branch 1 compatible patch does not seem feasible.

      A solution for branch 1 is pretty simple though, am proposing a patch that simply uses WebAppContext, instead of Context, as the context for the HttpServer instance. WebAppContext will already restrict TRACE methods by default.

        Attachments

        1. HBASE-21275-branch-1.2.001.patch
          4 kB
          Wellington Chevreuil
        2. HBASE-21275-branch-1.2.002.patch
          4 kB
          Wellington Chevreuil
        3. HBASE-21275-branch-1.2.003.patch
          4 kB
          Wellington Chevreuil
        4. HBASE-21275-branch-1.2.003.patch
          4 kB
          Michael Stack
        5. HBASE-21275-branch-1.001.patch
          6 kB
          Wellington Chevreuil
        6. HBASE-21275-branch-1.4.001.patch
          7 kB
          Wellington Chevreuil

          Activity

            People

            • Assignee:
              wchevreuil Wellington Chevreuil
              Reporter:
              wchevreuil Wellington Chevreuil
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: