HBASE-28514: HBase web console automatically listing directories in static/css #5830

Kota-SH · 2024-04-15T18:51:16Z

Jira: https://issues.apache.org/jira/browse/HBASE-28514

Apache-HBase · 2024-04-15T19:37:36Z

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 35s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	hbaseanti	0m 0s	Patch does not have any anti-patterns.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
		_ master Compile Tests _
+0 🆗	mvndep	0m 11s	Maven dependency ordering for branch
+1 💚	mvninstall	3m 1s	master passed
+1 💚	compile	3m 7s	master passed
+1 💚	checkstyle	0m 57s	master passed
+1 💚	spotless	0m 44s	branch has no errors when running spotless:check.
+1 💚	spotbugs	1m 57s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 11s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 49s	the patch passed
+1 💚	compile	3m 7s	the patch passed
+1 💚	javac	3m 7s	the patch passed
-0 ⚠️	checkstyle	0m 10s	hbase-http: The patch generated 1 new + 0 unchanged - 0 fixed = 1 total (was 0)
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	xml	0m 1s	The patch has no ill-formed XML file.
+1 💚	hadoopcheck	4m 54s	Patch does not cause any errors with Hadoop 3.3.6.
-1 ❌	spotless	0m 21s	patch has 21 errors when running spotless:check, run spotless:apply to fix.
+1 💚	spotbugs	2m 14s	the patch passed
		_ Other Tests _
+1 💚	asflicense	0m 30s	The patch does not generate ASF License warnings.
		32m 2s

Subsystem	Report/Notes
Docker	ClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	dupname asflicense javac spotbugs hadoopcheck hbaseanti spotless checkstyle compile xml
uname	Linux bf5affe5fc9a 5.4.0-176-generic #196-Ubuntu SMP Fri Mar 22 16:46:39 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `4b7a39a`
Default Java	Eclipse Adoptium-11.0.17+8
checkstyle	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/diff-checkstyle-hbase-http.txt
spotless	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-general-check/output/patch-spotless.txt
Max. process+thread count	79 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versions	git=2.34.1 maven=3.8.6 spotbugs=4.7.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-04-15T23:09:55Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 13s	Docker mode activated.
-0 ⚠️	yetus	0m 3s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for branch
+1 💚	mvninstall	2m 59s	master passed
+1 💚	compile	1m 27s	master passed
+1 💚	shadedjars	5m 15s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 53s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 11s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 47s	the patch passed
+1 💚	compile	1m 30s	the patch passed
+1 💚	javac	1m 30s	the patch passed
+1 💚	shadedjars	5m 12s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 52s	the patch passed
		_ Other Tests _
+1 💚	unit	0m 55s	hbase-http in the patch passed.
+1 💚	unit	216m 41s	hbase-server in the patch passed.
+1 💚	unit	0m 29s	hbase-shaded-testing-util in the patch passed.
		244m 21s

Subsystem	Report/Notes
Docker	ClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux 720bd85eab5d 5.4.0-172-generic #190-Ubuntu SMP Fri Feb 2 23:24:22 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `4b7a39a`
Default Java	Eclipse Adoptium-17.0.10+7
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count	5404 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-04-15T23:22:57Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 39s	Docker mode activated.
-0 ⚠️	yetus	0m 2s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 15s	Maven dependency ordering for branch
+1 💚	mvninstall	4m 1s	master passed
+1 💚	compile	1m 41s	master passed
+1 💚	shadedjars	8m 30s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	1m 6s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 11s	Maven dependency ordering for patch
+1 💚	mvninstall	3m 23s	the patch passed
+1 💚	compile	1m 43s	the patch passed
+1 💚	javac	1m 43s	the patch passed
+1 💚	shadedjars	5m 37s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 41s	the patch passed
		_ Other Tests _
+1 💚	unit	0m 47s	hbase-http in the patch passed.
+1 💚	unit	224m 3s	hbase-server in the patch passed.
+1 💚	unit	0m 22s	hbase-shaded-testing-util in the patch passed.
		257m 8s

Subsystem	Report/Notes
Docker	ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux 8cb251143571 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `4b7a39a`
Default Java	Temurin-1.8.0_352-b08
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count	5431 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-04-15T23:44:31Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	1m 10s	Docker mode activated.
-0 ⚠️	yetus	0m 2s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for branch
+1 💚	mvninstall	3m 15s	master passed
+1 💚	compile	1m 49s	master passed
+1 💚	shadedjars	6m 45s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 54s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for patch
+1 💚	mvninstall	3m 20s	the patch passed
+1 💚	compile	1m 42s	the patch passed
+1 💚	javac	1m 42s	the patch passed
+1 💚	shadedjars	6m 47s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 48s	the patch passed
		_ Other Tests _
+1 💚	unit	1m 0s	hbase-http in the patch passed.
+1 💚	unit	245m 25s	hbase-server in the patch passed.
+1 💚	unit	1m 6s	hbase-shaded-testing-util in the patch passed.
		278m 53s

Subsystem	Report/Notes
Docker	ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux 3d219434a9dc 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `4b7a39a`
Default Java	Eclipse Adoptium-11.0.17+8
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/testReport/
Max. process+thread count	4508 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/1/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache9 · 2024-04-21T14:29:53Z

Mind explaining a bit?

Thanks.

stoty · 2024-04-24T06:44:41Z

The changes look OK.

My concern is whether this breaks existing functionality.
IIRC there are some screens where the UI lets you download files.
Won't those be broken by this change ?

Kota-SH · 2024-04-24T17:25:10Z

Mind explaining a bit?

Thanks.

@Apache9 Thanks for the review!
So the issue is that the HBase UI automatically lists the contents of the /static directory when called explicitly by appending the HBase master URL with '/static'. For example- https://hbase-master:22002/static/
This could be a security concern.
This patch adds an index file in the /static so that the directories are not listed and the URL is redirected to the master UI home.

Kota-SH · 2024-04-24T17:30:38Z

The changes look OK.

My concern is whether this breaks existing functionality. IIRC there are some screens where the UI lets you download files. Won't those be broken by this change ?

@stoty Thanks for the review.
We are only adding the index file to the static directory and changing the static context to admin-authorized servlet.
AFAIU, this doesn't affect other screens.
Please let me know if there is anything I'm missing here.

stoty · 2024-04-24T17:36:34Z

...il/src/main/resources/org/apache/hadoop/hbase/shaded/org/eclipse/jetty/webapp/webdefault.xml

    <init-param>
      <param-name>dirAllowed</param-name>
-      <param-value>true</param-value>
+      <param-value>false</param-value>


This looks like a general default setting to me, @Kota-SH .

…tatic/css

Apache-HBase · 2024-06-05T19:06:48Z

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 0s	Docker mode activated.
-1 ❌	docker	0m 1s	Docker failed to build yetus/hbase:8a715fadd5.

Subsystem	Report/Notes
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versions	git=2.17.1
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-06-05T23:09:43Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 11s	Docker mode activated.
-0 ⚠️	yetus	0m 3s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 11s	Maven dependency ordering for branch
+1 💚	mvninstall	2m 52s	master passed
+1 💚	compile	1m 27s	master passed
+1 💚	shadedjars	5m 13s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 53s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 48s	the patch passed
+1 💚	compile	1m 28s	the patch passed
+1 💚	javac	1m 28s	the patch passed
+1 💚	shadedjars	5m 9s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 52s	the patch passed
		_ Other Tests _
+1 💚	unit	0m 55s	hbase-http in the patch passed.
+1 💚	unit	216m 7s	hbase-server in the patch passed.
+1 💚	unit	0m 32s	hbase-shaded-testing-util in the patch passed.
		243m 44s

Subsystem	Report/Notes
Docker	ClientAPI=1.45 ServerAPI=1.45 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk17-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux 4587204f7b80 5.4.0-182-generic #202-Ubuntu SMP Fri Apr 26 12:29:36 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `8afd93e`
Default Java	Eclipse Adoptium-17.0.10+7
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count	4802 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-06-05T23:19:50Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 30s	Docker mode activated.
-0 ⚠️	yetus	0m 2s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 18s	Maven dependency ordering for branch
+1 💚	mvninstall	2m 42s	master passed
+1 💚	compile	1m 5s	master passed
+1 💚	shadedjars	5m 40s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 44s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for patch
+1 💚	mvninstall	2m 23s	the patch passed
+1 💚	compile	1m 10s	the patch passed
+1 💚	javac	1m 10s	the patch passed
+1 💚	shadedjars	5m 40s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 42s	the patch passed
		_ Other Tests _
+1 💚	unit	0m 47s	hbase-http in the patch passed.
+1 💚	unit	227m 16s	hbase-server in the patch passed.
+1 💚	unit	0m 21s	hbase-shaded-testing-util in the patch passed.
		253m 47s

Subsystem	Report/Notes
Docker	ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux f0475d19b861 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `8afd93e`
Default Java	Temurin-1.8.0_352-b08
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count	5158 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

Apache-HBase · 2024-06-05T23:51:32Z

🎊 +1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	0m 42s	Docker mode activated.
-0 ⚠️	yetus	0m 2s	Unprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
		_ Prechecks _
		_ master Compile Tests _
+0 🆗	mvndep	0m 14s	Maven dependency ordering for branch
+1 💚	mvninstall	3m 14s	master passed
+1 💚	compile	1m 51s	master passed
+1 💚	shadedjars	7m 8s	branch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 50s	master passed
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 12s	Maven dependency ordering for patch
+1 💚	mvninstall	3m 35s	the patch passed
+1 💚	compile	1m 33s	the patch passed
+1 💚	javac	1m 33s	the patch passed
+1 💚	shadedjars	7m 28s	patch has no errors when building our shaded downstream artifacts.
+1 💚	javadoc	0m 55s	the patch passed
		_ Other Tests _
+1 💚	unit	1m 18s	hbase-http in the patch passed.
+1 💚	unit	251m 10s	hbase-server in the patch passed.
+1 💚	unit	0m 43s	hbase-shaded-testing-util in the patch passed.
		285m 30s

Subsystem	Report/Notes
Docker	ClientAPI=1.43 ServerAPI=1.43 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR	#5830
JIRA Issue	HBASE-28514
Optional Tests	javac javadoc unit shadedjars compile
uname	Linux f53ae3b56e37 5.4.0-1103-aws #111~18.04.1-Ubuntu SMP Tue May 23 20:04:10 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/hbase-personality.sh
git revision	master / `8afd93e`
Default Java	Eclipse Adoptium-11.0.17+8
Test Results	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/testReport/
Max. process+thread count	4487 (vs. ulimit of 30000)
modules	C: hbase-http hbase-server hbase-shaded/hbase-shaded-testing-util U: .
Console output	https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-5830/2/console
versions	git=2.34.1 maven=3.8.6
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

stoty · 2024-06-06T05:05:49Z

hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java

    ServletContextHandler staticContext = new ServletContextHandler(parent, "/static");
    staticContext.setResourceBase(appDir + "/static");
-    staticContext.addServlet(DefaultServlet.class, "/*");
+    staticContext.addServlet(AdminAuthorizedServlet.class, "/*");


What does AdminAuthorizedServlet do ?

We don't want to limit the static folder to admin users.

ankitsinghal requested review from petersomogyi, stoty and wchevreuil April 24, 2024 04:20

stoty reviewed Apr 24, 2024

View reviewed changes

HBASE-28514: HBase web console automatically listing directories in s…

6e8f71b

…tatic/css

Kota-SH force-pushed the HBASE-28514 branch from ba1ccbb to 6e8f71b Compare June 5, 2024 18:59

stoty reviewed Jun 6, 2024

View reviewed changes

HBASE-28514: HBase web console automatically listing directories in static/css #5830

Are you sure you want to change the base?

HBASE-28514: HBase web console automatically listing directories in static/css #5830

Conversation

Kota-SH commented Apr 15, 2024

Uh oh!

Apache-HBase commented Apr 15, 2024

Uh oh!

Apache-HBase commented Apr 15, 2024

Uh oh!

Apache-HBase commented Apr 15, 2024

Uh oh!

Apache-HBase commented Apr 15, 2024

Uh oh!

Apache9 commented Apr 21, 2024

Uh oh!

stoty commented Apr 24, 2024

Uh oh!

Kota-SH commented Apr 24, 2024

Uh oh!

Kota-SH commented Apr 24, 2024

Uh oh!

stoty Apr 24, 2024

Choose a reason for hiding this comment

Uh oh!

Apache-HBase commented Jun 5, 2024

Uh oh!

Apache-HBase commented Jun 5, 2024

Uh oh!

Apache-HBase commented Jun 5, 2024

Uh oh!

Apache-HBase commented Jun 5, 2024

Uh oh!

stoty Jun 6, 2024

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants