[YARN-2528] Cross Origin Filter Http response split vulnerability protection rejects valid origins

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0
• Component/s: timelineserver
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Jonathan Turner Eagles
• Reporter: Jonathan Turner Eagles
• Created: 09/Sep/14 20:42
• Updated: 01/Dec/14 03:08
• Resolved: 13/Sep/14 04:38

Description

URLEncoding is too strong of a protection for HTTP Response Split Vulnerability protection and major browser reject the encoded Origin. An adequate protection is simply to remove all CRs LFs as in the case of PHP's header function.