Apache
/
hbase
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

HBASE-27792 Guard Master/RS Dump Servlet behind admin walls (#5176)

This commit is contained in:
Nihal Jain 2023-04-25 09:42:01 +05:30 committed by GitHub
parent 22164147d0
commit a1f2b4e1d0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hbase-server/src/main/java/org/apache/hadoop/hbase/master/http/MasterDumpServlet.java
View File

@ -28,6 +28,7 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.ServerMetrics;
import org.apache.hadoop.hbase.ServerName;
import org.apache.hadoop.hbase.http.HttpServer;
import org.apache.hadoop.hbase.master.HMaster;
import org.apache.hadoop.hbase.master.ServerManager;
import org.apache.hadoop.hbase.master.assignment.AssignmentManager;
@ -45,6 +46,9 @@ public class MasterDumpServlet extends StateDumpServlet {
@Override
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
if (!HttpServer.isInstrumentationAccessAllowed(getServletContext(), request, response)) {
return;
}
HMaster master = (HMaster) getServletContext().getAttribute(HMaster.MASTER);
assert master != null : "No Master in context!";

4
hbase-server/src/main/java/org/apache/hadoop/hbase/regionserver/http/RSDumpServlet.java
View File

@ -25,6 +25,7 @@ import java.util.Date;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.http.HttpServer;
import org.apache.hadoop.hbase.ipc.CallQueueInfo;
import org.apache.hadoop.hbase.monitoring.StateDumpServlet;
import org.apache.hadoop.hbase.monitoring.TaskMonitor;
@ -42,6 +43,9 @@ public class RSDumpServlet extends StateDumpServlet {
@Override
public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
if (!HttpServer.isInstrumentationAccessAllowed(getServletContext(), request, response)) {
return;
}
HRegionServer hrs =
(HRegionServer) getServletContext().getAttribute(HRegionServer.REGIONSERVER);
assert hrs != null : "No RS in context!";