[branch-4.1][fix](security) Add auth and config gate for _stream_load_forward endpoint#65377
Open
liaoxin01 wants to merge 1 commit into
Open
[branch-4.1][fix](security) Add auth and config gate for _stream_load_forward endpoint#65377liaoxin01 wants to merge 1 commit into
liaoxin01 wants to merge 1 commit into
Conversation
…point (apache#64935) - **SSRF fix**: `_stream_load_forward` BE endpoint was registered unconditionally without authentication, allowing unauthenticated SSRF attacks - Add BE config `enable_group_commit_streamload_be_forward` (default `false`) to gate endpoint registration, matching the existing FE config name
Contributor
|
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports a security fix to the BE _stream_load_forward endpoint by adding an explicit BE-side config gate and wiring the endpoint into the existing HTTP auth framework, aligning it with cloud group-commit forwarding behavior.
Changes:
- Gate
/api/{db}/{table}/_stream_load_forwardbehindenable_group_commit_streamload_be_forward(defaultfalse) in BE. - Require HTTP auth for the forward handler by converting it to
HttpHandlerWithAuthand passingExecEnvfromHttpService. - Update the regression test cluster config to enable the feature flag on both FE and BE.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy | Enables the new BE config gate in the regression test cluster setup. |
| be/src/service/http/action/stream_load_forward_handler.h | Switches the handler base class to HttpHandlerWithAuth and adds an ExecEnv* constructor. |
| be/src/service/http/action/stream_load_forward_handler.cpp | Adds the runtime config gate and calls the auth hook in on_header. |
| be/src/service/http_service.cpp | Constructs the forward handler with _env (required for auth). |
| be/src/common/config.h | Declares the new BE config enable_group_commit_streamload_be_forward. |
| be/src/common/config.cpp | Defines the new BE config with default false. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Author
|
run buildall |
1 similar comment
Contributor
Author
|
run buildall |
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
1 similar comment
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
Contributor
BE Regression && UT Coverage ReportIncrement line coverage Increment coverage report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pick #64935