Skip to content

TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read profiler output #526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abstractdog merged 1 commit into from
Jul 22, 2026
+9 −1
Merged

TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read profiler output #526

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.hadoop.http.HttpServer2;
import org.apache.hadoop.yarn.webapp.MimeType;

import org.eclipse.jetty.servlet.DefaultServlet;
Expand All @@ -40,6 +41,11 @@ public class ProfileOutputServlet extends DefaultServlet {
public static final String FILE_QUERY_PARAM = "file";

public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
if (!HttpServer2.isInstrumentationAccessAllowed(this.getServletContext(), request, response)) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
writeMessage(response, ProfileServlet.ACCESS_DENIED_MESSAGE);
return;
}
String queriedFile = request.getParameter(FILE_QUERY_PARAM);
if (queriedFile == null) {
writeMessage(response, "Run the profiler to be able to receive its output");
Expand Down
4 changes: 3 additions & 1 deletion tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,8 @@ public class ProfileServlet extends HttpServlet {
private static final String ALLOWED_METHODS = "GET";
private static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
private static final String CONTENT_TYPE_TEXT = "text/plain; charset=utf-8";

public static final String ACCESS_DENIED_MESSAGE = "Unauthorized: Instrumentation access is not allowed!";
private static final String ASYNC_PROFILER_HOME_ENV = "ASYNC_PROFILER_HOME";
private static final String ASYNC_PROFILER_HOME_SYSTEM_PROPERTY = "async.profiler.home";
private static final int DEFAULT_DURATION_SECONDS = 10;
Expand Down Expand Up @@ -165,7 +167,7 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro
if (!HttpServer2.isInstrumentationAccessAllowed(this.getServletContext(), request, response)) {
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
setResponseHeader(response);
out.println("Unauthorized: Instrumentation access is not allowed!");
out.println(ACCESS_DENIED_MESSAGE);
out.close();
return;
}
Expand Down
Loading