Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Improvement] Ensure that HttpUtils can only get result from certification URL #15288

Merged
merged 37 commits into from
Dec 23, 2023
Merged

[Improvement] Ensure that HttpUtils can only get result from certification URL #15288

merged 37 commits into from
Dec 23, 2023

Conversation

davidzollo
Copy link
Contributor

Ensure that HttpUtils can only access secure URL

davidzollo and others added 23 commits August 1, 2022 19:06
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
9ffc010
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
137e890
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
063026c
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
0ad2f52
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
c2eb498
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
a6b3ce1
@davidzollo
update the slack invitation
e8d45f9
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
c6e2059
@davidzollo
Contribute.md
9311706
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
a3e24b8
@davidzollo
Merge pull request #1 from davidzollo/davidzollo-patch-134
d90b7a1 
Contribute.md
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
449cf5a
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
904971e
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
ae560f1
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
70a318b
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
442837b
@davidzollo
Merge remote-tracking branch 'upstream/dev' into dev
3a80d85
@davidzollo
make httputils just can get Http request not Https
1e8c5c7
@davidzollo
Merge remote-tracking branch 'origin/dev' into dev
7373157 
# Conflicts:
#	CONTRIBUTING.md
@davidzollo
Merge branch 'apache:dev' into dev
295e9b4
@davidzollo
update the slack invitation
a653c67
@davidzollo
Merge remote-tracking branch 'origin/dev' into dev
0b4c671
@davidzollo
add test
0aa830c
@mergeable mergeable bot removed the backend label Dec 6, 2023
@zhongjiajie
Copy link
Member

please run ./mvnw spotless:check to format the code

@zhongjiajie zhongjiajie self-requested a review December 7, 2023 10:49
ruanwenjun
ruanwenjun reviewed Dec 7, 2023
View reviewed changes
...inscheduler-common/src/test/java/org/apache/dolphinscheduler/common/utils/HttpUtilsTest.java

@Test
void testGetRequest() {
// test HTTP URL
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be better if there exist an incorrect url case?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davidzollo

@ruanwenjun ruanwenjun added the bug Something isn't working label Dec 7, 2023
@davidzollo
Copy link
Contributor Author

please run ./mvnw spotless:check to format the code

has updated, please help check

@davidzollo davidzollo changed the title [Improvement] Ensure that HttpUtils can only access secure URL [Improvement] Ensure that HttpUtils can only visit certification URL Dec 8, 2023
@codecov-commenter
Copy link

codecov-commenter commented Dec 8, 2023 •
edited
Loading

Codecov Report

Attention: 9 lines in your changes are missing coverage. Please review.

Comparison is base (b7ffa74) 37.81% compared to head (a3526fe) 37.80%.

❗ Current head a3526fe differs from pull request most recent head 82ad7db. Consider uploading reports for the commit 82ad7db to get more accurate results

Files Patch % Lines
...pache/dolphinscheduler/common/utils/HttpUtils.java 79.06% 7 Missing and 2 partials ⚠️
Additional details and impacted files 
@@             Coverage Diff              @@
##                dev   #15288      +/-   ##
============================================
- Coverage     37.81%   37.80%   -0.01%     
- Complexity     4701     4704       +3     
============================================
  Files          1304     1304              
  Lines         45216    45205      -11     
  Branches       4858     4856       -2     
============================================
- Hits          17099    17092       -7     
+ Misses        26254    26251       -3     
+ Partials       1863     1862       -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

zhongjiajie
zhongjiajie previously approved these changes Dec 9, 2023
View reviewed changes
Copy link
Member

@zhongjiajie zhongjiajie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Others LGTM

...inscheduler-common/src/test/java/org/apache/dolphinscheduler/common/utils/HttpUtilsTest.java

@Test
void testGetRequest() {
// test HTTP URL
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davidzollo

@davidzollo davidzollo changed the title [Improvement] Ensure that HttpUtils can only visit certification URL [Improvement] Ensure that HttpUtils can only get result from certification URL Dec 13, 2023
@davidzollo
Copy link
Contributor Author

@zhongjiajie updated, please take a look!

@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Dec 23, 2023

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@zhongjiajie zhongjiajie merged commit a0bc778 into apache:dev Dec 23, 2023
52 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ruanwenjun ruanwenjun ruanwenjun left review comments

@zhongjiajie zhongjiajie zhongjiajie approved these changes

@caishunfeng caishunfeng Awaiting requested review from caishunfeng

Assignees

@davidzollo davidzollo

Labels
backend bug Something isn't working priority:high ready-to-merge
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@davidzollo @zhongjiajie @codecov-commenter @ruanwenjun