[ZEPPELIN-4151] Any user can see configurations and notebooks despite shiro authentication

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 0.8.1
• Fix Version/s: 0.9.0
• Component/s: GUI, Interpreters
• Labels: easyfix security

Environment

Linux

• Flags: Patch, Important
• Assignee: Unassigned
• Reporter: Hamid Mushtaq
• Created: 11/May/19 18:58
• Updated: 29/Sep/19 05:56

Description

Without user impersonification (which is impossible with %spark anyway), a user can just write a simple script to see any file in the Zeppelin folder, including shiro.ini or any notes. So, the users and passwords in shiro become pretty meaningless. Can't zeppelin just disallow such peeking?

For example, any user can just execute the following in a note to get what is inside the shiro.ini file.

import scala.sys.process._
"cat conf/shiro.ini".!!

 I know that one can use livy.spark instead for proper user impersonification, but then you can't use ZeppelinContext variable z.

Issue Links

• blocks: ZEPPELIN-4317 Release version 0.8.2
• relates to: ZEPPELIN-4053 Implement impersonation via c native api