Uploaded image for project: 'Hive'
  1. Hive
  2. HIVE-23704

Thrift HTTP Server Does Not Handle Auth Handle Correctly

    XMLWordPrintableJSON

Details

    Description

      ThriftHttpServlet.java
        private String[] getAuthHeaderTokens(HttpServletRequest request,
            String authType) throws HttpAuthenticationException {
          String authHeaderBase64 = getAuthHeader(request, authType);
          String authHeaderString = StringUtils.newStringUtf8(
              Base64.decodeBase64(authHeaderBase64.getBytes()));
          String[] creds = authHeaderString.split(":");
          return creds;
        }
      

      So here, it takes the authHeaderBase64 (which is a base-64 string), and converts it into bytes, and then it tries to decode those bytes. That is incorrect It should covert base-64 string directly into bytes.

      I tried to do this as part of HIVE-22676 and the tests was failing because the string that is being decoded is not actually Base-64 (see attached image) It has a stray space and a colon. Again, the existing code doesn't care because it's not parsing Base-64 text, it is parsing the bytes generated by converting base-64 text to bytes.

      I'm not sure what affect this has, what security issues this may present, but it's definitely not correct.

      Attachments

        1. Base64NegotiationError.png
          94 kB
          David Mollitor

        Issue Links

          Activity

            People

              belugabehr David Mollitor
              belugabehr David Mollitor
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1.5h
                  1.5h