[HDFS-11048] Audit Log should escape control characters - ASF JIRA

XML

Word

Printable

JSON

Target Version/s:

2.8.0
Hadoop Flags:

Incompatible change, Reviewed
Release Note:

Hide
HDFS audit logs are formatted as individual lines, each of which has a few of key-value pair fields. Some of the values come from client request (e.g. src, dst). Before this patch the control characters including \t \n etc are not escaped in audit logs. That may break lines unexpectedly or introduce additional table character (in the worst case, both) within a field. Tools that parse audit logs had to deal with this case carefully. After this patch, the control characters in the src/dst fields are escaped.

Show
HDFS audit logs are formatted as individual lines, each of which has a few of key-value pair fields. Some of the values come from client request (e.g. src, dst). Before this patch the control characters including \t \n etc are not escaped in audit logs. That may break lines unexpectedly or introduce additional table character (in the worst case, both) within a field. Tools that parse audit logs had to deal with this case carefully. After this patch, the control characters in the src/dst fields are escaped.

Allowing control characters without escaping them allows for spoofing audit log entries at worst and accidentally breaking log parsing at best.