Skip to content

Commit

Permalink
fix reportal regression bug introduced by security fix #1325 (#1730)
Browse files Browse the repository at this point in the history
We found a security hole in #1325 that any job is able to leverage execute-as-user to impersonate any unix account. when we tryied rolling out this fix to Reportal server, we run into an exception for all ReportalPig jobs:

The cause is that the job process is not able to create a file under the same source script folder, because of the change (#1325).

In this PR, I used the most straightforward solution to create the bak file under the root working directory.
  • Loading branch information
kunkun-tang committed Apr 16, 2018
1 parent f9ec3aa commit 8ab0662
Showing 1 changed file with 7 additions and 1 deletion.
Expand Up @@ -47,10 +47,12 @@ public class ReportalPigRunner extends ReportalAbstractRunner {
public static final String PIG_SCRIPT = "reportal.pig.script";
public static final String UDF_IMPORT_LIST = "udf.import.list";
public static final String PIG_ADDITIONAL_JARS = "pig.additional.jars";
private final String jobName;
Props prop;

public ReportalPigRunner(final String jobName, final Properties props) {
super(props);
this.jobName = jobName;
this.prop = new Props();
this.prop.put(props);
}
Expand Down Expand Up @@ -218,7 +220,11 @@ private void injectAllVariables(final String file) throws FileNotFoundException
// Inject variables into the script
System.out.println("Reportal Pig: Replacing variables");
final File inputFile = new File(file);
final File outputFile = new File(file + ".bak");

// Creating a bak file under the root working directory, in order to copy the original pig
// script to here with injected variables.
final File outputFile = new File(this.jobName + ".bak");

final InputStream scriptInputStream =
new BufferedInputStream(new FileInputStream(inputFile));
final Scanner rowScanner = new Scanner(scriptInputStream, StandardCharsets.UTF_8.toString());
Expand Down

0 comments on commit 8ab0662

Please sign in to comment.