[HDFS-6368] TransferFsImage#receiveFile() should perform validation on fsImageName parameter

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Assignee: Unassigned
• Reporter: Ted Yu
• Created: 10/May/14 22:58
• Updated: 12/Jun/14 20:50
• Resolved: 12/Jun/14 20:50

Description

Currently only null check is performed:

          if (fsImageName == null) {
            throw new IOException("No filename header provided by server");
          }
          newLocalPaths.add(new File(localPath, fsImageName));

Value of fsImageName, obtained from HttpURLConnection header, may be tainted.
This may allow an attacker to access, modify, or test the existence of critical or sensitive files.