From 4cbf9ad8480e4d4e26ac8e7e7af150aeeba7634c Mon Sep 17 00:00:00 2001 From: Josh Elser Date: Thu, 23 May 2019 20:39:52 -0400 Subject: [PATCH] HBASE-22467 UI fixes to enable Knox proxying --- .../hbase/http/ProfileOutputServlet.java | 21 +++++++++++-- .../hadoop/hbase/http/ProfileServlet.java | 2 +- .../hbase/http/TestProfileOutputServlet.java | 30 +++++++++++++++++++ .../hbase/tmpl/common/TaskMonitorTmpl.jamon | 3 +- .../hbase/tmpl/master/MasterStatusTmpl.jamon | 4 +-- .../tmpl/regionserver/RSStatusTmpl.jamon | 4 +-- .../resources/hbase-webapps/master/table.jsp | 2 +- 7 files changed, 57 insertions(+), 9 deletions(-) create mode 100644 hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java index 670c3ac1b8..55146040ab 100644 --- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java +++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java @@ -19,6 +19,7 @@ package org.apache.hadoop.hbase.http; import java.io.File; import java.io.IOException; +import java.util.regex.Pattern; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; @@ -37,6 +38,8 @@ public class ProfileOutputServlet extends DefaultServlet { private static final long serialVersionUID = 1L; private static final Logger LOG = LoggerFactory.getLogger(ProfileOutputServlet.class); private static final int REFRESH_PERIOD = 2; + // Alphanumeric characters, plus percent (url-encoding), equals, and ampersand + private static final Pattern ALPHA_NUMERIC = Pattern.compile("[a-zA-Z0-9\\%\\=\\&]*"); @Override protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) @@ -48,11 +51,25 @@ public class ProfileOutputServlet extends DefaultServlet { // will be <100 bytes (in all modes). if (requestedFile.length() < 100) { LOG.info(requestedFile + " is incomplete. Sending auto-refresh header."); - resp.setHeader("Refresh", REFRESH_PERIOD + "," + req.getRequestURI()); + String refreshUrl = req.getRequestURI(); + // Rebuild the query string (if we have one) + if (req.getQueryString() != null) { + refreshUrl += "?" + sanitize(req.getQueryString()); + } + ProfileServlet.setResponseHeader(resp); + resp.setHeader("Refresh", REFRESH_PERIOD + ";" + refreshUrl); resp.getWriter().write("This page will be auto-refreshed every " + REFRESH_PERIOD + - " seconds until the output file is ready."); + " seconds until the output file is ready. Redirecting to " + refreshUrl); } else { super.doGet(req, resp); } } + + static String sanitize(String input) { + // Basic test to try to avoid any XSS attacks or HTML content showing up. + if (ALPHA_NUMERIC.matcher(input).matches()) { + return input; + } + throw new RuntimeException("Non-alphanumeric data found in input, aborting."); + } } diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java index 5dfaa32879..642d05a314 100644 --- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java +++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java @@ -361,7 +361,7 @@ public class ProfileServlet extends HttpServlet { return Output.SVG; } - private static void setResponseHeader(final HttpServletResponse response) { + static void setResponseHeader(final HttpServletResponse response) { response.setHeader(ACCESS_CONTROL_ALLOW_METHODS, ALLOWED_METHODS); response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, "*"); response.setContentType(CONTENT_TYPE_TEXT); diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java new file mode 100644 index 0000000000..aec123e737 --- /dev/null +++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java @@ -0,0 +1,30 @@ +package org.apache.hadoop.hbase.http; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.util.Arrays; +import java.util.List; + +import org.junit.Test; + +public class TestProfileOutputServlet { + + @Test + public void testSanitization() { + List good = Arrays.asList("abcd", "key=value", "key1=value&key2=value2", ""); + for (String input : good) { + assertEquals(input, ProfileOutputServlet.sanitize(input)); + } + List bad = Arrays.asList("function(){console.log(\"oops\")}", "uhoh"); + for (String input : bad) { + try { + ProfileOutputServlet.sanitize(input); + fail("Expected sanitization of \"" + input + "\" to fail"); + } catch (RuntimeException e) { + // Pass + } + } + } + +} diff --git a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon index c4dff1458f..f700d39947 100644 --- a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon +++ b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon @@ -25,6 +25,7 @@ org.apache.hadoop.util.StringUtils; TaskMonitor taskMonitor = TaskMonitor.get(); String filter = "general"; String format = "html"; +String parent = ""; <%if format.equals("json")%> @@ -79,7 +80,7 @@ String format = "html"; <%args> String filter; - View as JSON + View as JSON <%def renderTasks> diff --git a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon index 06fe2c9499..3d7106c01f 100644 --- a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon +++ b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon @@ -146,7 +146,7 @@ AssignmentManager assignmentManager = master.getAssignmentManager();