Skip to content

There is a bug can run any command on linux when use opentsdb ui  #793

@mzw-g

Description

@mzw-g

if there is a wrong parameter such like "wxh=1900x770ls /home/" it will cause an "IllegalArgumentException",And then be process with "badRequest" , because this response with "PNG" , the wrong parameter will be worte to a script ,add run。

there is a sample way to fix it temporarily
`---a/expand/opentsdb/src/tsd/HttpQuery.java
+++ b/expand/opentsdb/src/tsd/HttpQuery.java
@@ -421,8 +421,8 @@ final class HttpQuery extends AbstractHttpQuery {
HttpQuery.escapeJson(exception.getMessage(), buf);
buf.append(""}");
sendReply(HttpResponseStatus.BAD_REQUEST, buf);

  • } else if (hasQueryStringParam("png")) {
  •  sendAsPNG(HttpResponseStatus.BAD_REQUEST, exception.getMessage(), 3600);
    
  • //} else if (hasQueryStringParam("png")) {
  •  //sendAsPNG(HttpResponseStatus.BAD_REQUEST, exception.getMessage(), 3600);
    
    } else {
    sendReply(HttpResponseStatus.BAD_REQUEST,
    makePage("Bad Request", "Looks like it's your fault this time",`

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions