Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix URI local path traversal #11473

Merged
merged 2 commits into from
Mar 20, 2024
Merged

Conversation

daniellok-db
Copy link
Collaborator

@daniellok-db daniellok-db commented Mar 20, 2024

🛠 DevTools 🛠

Open in GitHub Codespaces

Install mlflow from this PR

pip install git+https://github.com/mlflow/mlflow.git@refs/pull/11473/merge

Checkout with GitHub CLI

gh pr checkout 11473

Related Issues/PRs

#xxx

What changes are proposed in this pull request?

This PR addresses a security concern caused by URI parsing for URIs containing semicolons.

How is this PR tested?

  • Existing unit/integration tests
  • New unit/integration tests
  • Manual tests

Does this PR require documentation update?

  • No. You can skip the rest of this section.
  • Yes. I've updated:
    • Examples
    • API references
    • Instructions

Release Notes

Is this a user-facing change?

  • No. You can skip the rest of this section.
  • Yes. Give a description of this change to be included in the release notes for MLflow users.

What component(s), interfaces, languages, and integrations does this PR affect?

Components

  • area/artifacts: Artifact stores and artifact logging
  • area/build: Build and test infrastructure for MLflow
  • area/deployments: MLflow Deployments client APIs, server, and third-party Deployments integrations
  • area/docs: MLflow documentation pages
  • area/examples: Example code
  • area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
  • area/models: MLmodel format, model serialization/deserialization, flavors
  • area/recipes: Recipes, Recipe APIs, Recipe configs, Recipe Templates
  • area/projects: MLproject format, project running backends
  • area/scoring: MLflow Model server, model deployment tools, Spark UDFs
  • area/server-infra: MLflow Tracking server backend
  • area/tracking: Tracking Service, tracking client APIs, autologging

Interface

  • area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
  • area/docker: Docker use across MLflow's components, such as MLflow Projects and MLflow Models
  • area/sqlalchemy: Use of SQLAlchemy in the Tracking Service or Model Registry
  • area/windows: Windows support

Language

  • language/r: R APIs and clients
  • language/java: Java APIs and clients
  • language/new: Proposals for new client languages

Integrations

  • integrations/azure: Azure and Azure ML integrations
  • integrations/sagemaker: SageMaker integrations
  • integrations/databricks: Databricks integrations

How should the PR be classified in the release notes? Choose one:

  • rn/none - No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" section
  • rn/breaking-change - The PR will be mentioned in the "Breaking Changes" section
  • rn/feature - A new user-facing feature worth mentioning in the release notes
  • rn/bug-fix - A user-facing bug fix worth mentioning in the release notes
  • rn/documentation - A user-facing documentation change worth mentioning in the release notes

@github-actions github-actions bot added area/tracking Tracking service, tracking client APIs, autologging rn/none List under Small Changes in Changelogs. labels Mar 20, 2024
Copy link

github-actions bot commented Mar 20, 2024

Documentation preview for 7e7b609 will be available when this CircleCI job
completes successfully.

More info

@@ -599,13 +599,13 @@ def _create_experiment():
tags = [ExperimentTag(tag.key, tag.value) for tag in request_message.tags]

# Validate query string in artifact location to prevent attacks
parsed_artifact_locaion = urllib.parse.urlparse(request_message.artifact_location)
if parsed_artifact_locaion.fragment:
parsed_artifact_location = urllib.parse.urlparse(request_message.artifact_location)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix typo (locaion -> location)

Copy link
Collaborator

@WeichenXu123 WeichenXu123 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Signed-off-by: Daniel Lok <daniel.lok@databricks.com>
Signed-off-by: Daniel Lok <daniel.lok@databricks.com>
@daniellok-db
Copy link
Collaborator Author

force push to retrigger CI

@daniellok-db daniellok-db merged commit 695d287 into mlflow:master Mar 20, 2024
37 checks passed
BenWilson2 pushed a commit that referenced this pull request Mar 20, 2024
B-Step62 pushed a commit to B-Step62/mlflow that referenced this pull request Mar 25, 2024
artjen pushed a commit to artjen/mlflow that referenced this pull request Mar 26, 2024
Signed-off-by: Arthur Jenoudet <arthur.jenoudet@databricks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/tracking Tracking service, tracking client APIs, autologging rn/none List under Small Changes in Changelogs.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants