Skip to content

Commit 8009468

Browse files
srowendongjoon-hyun
authored andcommitted
[SPARK-29556][CORE] Avoid putting request path in error response in ErrorServlet
### What changes were proposed in this pull request? Don't include `$path` from user query in the error response. ### Why are the changes needed? The path could contain input that is then rendered as HTML in the error response. It's not clear whether it's exploitable, but better safe than sorry as the path info really isn't that important in this context. ### Does this PR introduce any user-facing change? No ### How was this patch tested? Existing tests. Closes #26211 from srowen/SPARK-29556. Authored-by: Sean Owen <[email protected]> Signed-off-by: Dongjoon Hyun <[email protected]>
1 parent 2036a8c commit 8009468

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

core/src/main/scala/org/apache/spark/deploy/rest/RestSubmissionServer.scala

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -317,8 +317,7 @@ private class ErrorServlet extends RestServlet {
317317
versionMismatch = true
318318
s"Unknown protocol version '$unknownVersion'."
319319
case _ =>
320-
// never reached
321-
s"Malformed path $path."
320+
"Malformed path."
322321
}
323322
msg += s" Please submit requests through http://[host]:[port]/$serverVersion/submissions/..."
324323
val error = handleError(msg)

0 commit comments

Comments
 (0)