Skip to content

Update ControllerAdminApiApplication.java#13132

Closed
sar12332111 wants to merge 1 commit intoapache:masterfrom
sar12332111:patch-1
Closed

Update ControllerAdminApiApplication.java#13132
sar12332111 wants to merge 1 commit intoapache:masterfrom
sar12332111:patch-1

Conversation

@sar12332111
Copy link

Secure static file handling to prevent path traversal attacks

  • Implemented a new SafeStaticHttpHandler
  • Configured the ControllerAdminApiApplication
  • Modified the setupSwagger method to use SafeStaticHttpHandler
  • Added URL validation

Copy link
Contributor

@Jackie-Jiang Jackie-Jiang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution! Can you share more context on this type of attacks and and best practice to defend it

}
}
}
public class SafeStaticHttpHandler extends CLStaticHttpHandler {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please reformat the changes following Pinot Style

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/apache/pinot/pull/13124/files

contributed to this PR . closing this

@codecov-commenter
Copy link

codecov-commenter commented May 10, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 46.83%. Comparing base (59551e4) to head (e4c4bdd).
Report is 431 commits behind head on master.

Additional details and impacted files
@@              Coverage Diff              @@
##             master   #13132       +/-   ##
=============================================
- Coverage     61.75%   46.83%   -14.92%     
- Complexity      207     1084      +877     
=============================================
  Files          2436     1913      -523     
  Lines        133233   101274    -31959     
  Branches      20636    16324     -4312     
=============================================
- Hits          82274    47434    -34840     
- Misses        44911    50358     +5447     
+ Partials       6048     3482     -2566     
Flag Coverage Δ
custom-integration1 ?
integration ?
integration1 ?
integration2 ?
java-11 46.79% <ø> (-14.92%) ⬇️
java-21 46.66% <ø> (-14.97%) ⬇️
skip-bytebuffers-false 46.82% <ø> (-14.93%) ⬇️
skip-bytebuffers-true 46.63% <ø> (+18.90%) ⬆️
temurin 46.83% <ø> (-14.92%) ⬇️
unittests 46.83% <ø> (-14.92%) ⬇️
unittests1 46.83% <ø> (-0.06%) ⬇️
unittests2 ?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants