natas_hw
/
dolphinscheduler
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'dev' into fix-#netty-secruity

This commit is contained in:
fuchanghai 2024-05-09 15:06:35 +08:00 committed by GitHub
parent 1e86158e3a 60b019b729
commit a20bf00377
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/main/java/org/apache/dolphinscheduler/plugin/task/pytorch/GitProjectManager.java
View File

@ -33,12 +33,12 @@ import lombok.extern.slf4j.Slf4j;
public class GitProjectManager {
public static final String GIT_PATH_LOCAL = "GIT_PROJECT";
private static final Pattern GIT_CHECK_PATTERN = Pattern.compile("^(git@|https?://)");
private static final Pattern GIT_CHECK_PATTERN = Pattern.compile("^(git@|https?://)(?![&|])[^&|]+$");
private String path;
private String baseDir = ".";
public static boolean isGitPath(String path) {
return GIT_CHECK_PATTERN.matcher(path).find();
return GIT_CHECK_PATTERN.matcher(path).matches();
}
public void prepareProject() throws Exception {

6
dolphinscheduler-task-plugin/dolphinscheduler-task-pytorch/src/test/java/org/apache/dolphinscheduler/plugin/task/pytorch/PytorchTaskTest.java
View File

@ -72,6 +72,12 @@ public class PytorchTaskTest {
}
@Test
public void testGitProjectUrlInjection() {
Assertions.assertFalse(GitProjectManager.isGitPath("git@& cat /etc/passwd >/poc.txt #"));
Assertions.assertFalse(GitProjectManager.isGitPath("git@| cat /etc/passwd >/poc.txt #"));
}
@Test
public void testGitProject() {

2
dolphinscheduler-task-plugin/dolphinscheduler-task-remoteshell/src/main/java/org/apache/dolphinscheduler/plugin/task/remoteshell/RemoteExecutor.java
View File

@ -131,7 +131,7 @@ public class RemoteExecutor implements AutoCloseable {
int exitCode = -1;
log.info("Remote shell task run status: {}", logLine);
if (logLine.contains(STATUS_TAG_MESSAGE)) {
String status = logLine.replace(STATUS_TAG_MESSAGE, "").trim();
String status = StringUtils.substringAfter(logLine, STATUS_TAG_MESSAGE);
if (status.equals("0")) {
log.info("Remote shell task success");
exitCode = 0;