Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-23704

Thrift HTTP Server Does Not Handle Auth Handle Correctly

Log workAgile BoardRank to TopRank to BottomBulk Copy AttachmentsBulk Move AttachmentsVotersWatch issueWatchersCreate sub-taskConvert to sub-taskMoveLinkCloneLabelsUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    Description

      ThriftHttpServlet.java
        private String[] getAuthHeaderTokens(HttpServletRequest request,
            String authType) throws HttpAuthenticationException {
          String authHeaderBase64 = getAuthHeader(request, authType);
          String authHeaderString = StringUtils.newStringUtf8(
              Base64.decodeBase64(authHeaderBase64.getBytes()));
          String[] creds = authHeaderString.split(":");
          return creds;
        }
      

      So here, it takes the authHeaderBase64 (which is a base-64 string), and converts it into bytes, and then it tries to decode those bytes. That is incorrect It should covert base-64 string directly into bytes.

      I tried to do this as part of HIVE-22676 and the tests was failing because the string that is being decoded is not actually Base-64 (see attached image) It has a stray space and a colon. Again, the existing code doesn't care because it's not parsing Base-64 text, it is parsing the bytes generated by converting base-64 text to bytes.

      I'm not sure what affect this has, what security issues this may present, but it's definitely not correct.

      Attachments

        1. Base64NegotiationError.png
          94 kB
          David Mollitor

        Issue Links

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            belugabehr David Mollitor Assign to me
            belugabehr David Mollitor
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - Not Specified
              Not Specified
              Remaining:
              Remaining Estimate - 0h
              0h
              Logged:
              Time Spent - 1.5h
              1.5h

              Slack

                Issue deployment