Pārlūkot izejas kodu

HUE-4704 [security] Fixed Arbitrary host header accepted in Hue

(cherry picked from commit 992ee376602b41a3f9adb87cd53292eb4104770a)
Prakash Ranade 9 gadi atpakaļ
vecāks
revīzija
57f3ad4ede
2 mainītis faili ar 24 papildinājumiem un 2 dzēšanām
  1. 14 2
      desktop/core/src/desktop/conf.py
  2. 10 0
      desktop/core/src/desktop/tests.py

+ 14 - 2
desktop/core/src/desktop/conf.py

@@ -69,12 +69,24 @@ def coerce_file(path):
 def coerce_timedelta(value):
   return datetime.timedelta(seconds=int(value))
 
-def get_dn():
+def get_dn(fqdn=None):
   """This function returns fqdn(if possible)"""
   val = []
   LOG = logging.getLogger(__name__)
   try:
-    val.append(socket.getfqdn())
+    if fqdn is None:
+      fqdn = socket.getfqdn()
+
+    if '.' in fqdn:
+      tups = fqdn.split('.')
+      if len(tups) > 2:
+        val.append(".%s" % ('.'.join(tups[-2:])))
+      else:
+        LOG.warning("allowed_hosts value to '*'. It is a security risk")
+        val.append('*')
+    else:
+      LOG.warning("allowed_hosts value to '*'. It is a security risk")
+      val.append('*')
   except:
     LOG.warning("allowed_hosts value to '*'. It is a security risk")
     val.append('*')

+ 10 - 0
desktop/core/src/desktop/tests.py

@@ -1101,3 +1101,13 @@ def test_get_data_link():
 
   assert_equal('/filebrowser/view=/data/hue/1', get_data_link({'type': 'hdfs', 'path': '/data/hue/1'}))
   assert_equal('/metastore/table/default/sample_07', get_data_link({'type': 'hive', 'database': 'default', 'table': 'sample_07'}))
+
+def test_get_dn():
+  assert_equal(['*'], desktop.conf.get_dn(''))
+  assert_equal(['*'], desktop.conf.get_dn('localhost'))
+  assert_equal(['*'], desktop.conf.get_dn('localhost.localdomain'))
+  assert_equal(['*'], desktop.conf.get_dn('hue'))
+  assert_equal(['*'], desktop.conf.get_dn('hue.com'))
+  assert_equal(['.hue.com'], desktop.conf.get_dn('sql.hue.com'))
+  assert_equal(['.hue.com'], desktop.conf.get_dn('finance.sql.hue.com'))
+  assert_equal(['.hue.com'], desktop.conf.get_dn('bank.finance.sql.hue.com'))