Disallow GET requests to /management/commands endpoint #7910
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
Can we get this build kicked off? I merged in marinov-code's fix to the failing unit tests. |
Contributor
|
Approved the build request. |
Contributor
|
@wmh1108-sas , Could you please take a look at the failed tests? Thanks in advance. |
Contributor
Author
|
Can we try this once more since the integration and acceptance tests are now passing in develop? |
JinwooHwang
reviewed
Aug 27, 2025
Contributor
JinwooHwang
left a comment
JinwooHwang
left a comment
There was a problem hiding this comment.
This is a positive change that aligns with HTTP and REST best practices, improves security, and avoids unintended command execution via GET requests. Please ensure that documentation, tests, and client communication are updated accordingly.
JinwooHwang
pushed a commit
that referenced
this pull request
Sep 3, 2025
* Disallow GET requests to /management/commands endpoint (cherry picked from commit c8f9fd6)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For all changes:
Is there a JIRA ticket associated with this PR? Is it referenced in the commit message?
Has your PR been rebased against the latest commit within the target branch (typically
develop)?Is your initial contribution a single, squashed commit?
Does
gradlew buildrun cleanly?Have you written or updated unit tests to verify your changes?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?