spark/backport-CVE-2024-23945.patch
2024-12-15 13:16:24 +08:00

52 lines
1.7 KiB
Diff

From cf59b1f51c16301f689b4e0f17ba4dbd140e1b19 Mon Sep 17 00:00:00 2001
From: Sean Owen <srowen@gmail.com>
Date: Tue, 17 Oct 2023 16:10:56 -0700
Subject: [PATCH] [MINOR][SQL] Remove signature from Hive thriftserver
exception
### What changes were proposed in this pull request?
Don't return expected signature to caller in Hive thriftserver exception
### Why are the changes needed?
Please see private discussion
### Does this PR introduce _any_ user-facing change?
No
### How was this patch tested?
Existing tests
### Was this patch authored or co-authored using generative AI tooling?
No
Closes #43402 from srowen/HiveCookieSigner.
Authored-by: Sean Owen <srowen@gmail.com>
Signed-off-by: Dongjoon Hyun <dhyun@apple.com>
---
.../src/main/java/org/apache/hive/service/CookieSigner.java | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/CookieSigner.java b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/CookieSigner.java
index 782e47a6..4b8d2cb1 100644
--- a/sql/hive-thriftserver/src/main/java/org/apache/hive/service/CookieSigner.java
+++ b/sql/hive-thriftserver/src/main/java/org/apache/hive/service/CookieSigner.java
@@ -81,8 +81,7 @@ public class CookieSigner {
LOG.debug("Signature generated for " + rawValue + " inside verify is " + currentSignature);
}
if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())) {
- throw new IllegalArgumentException("Invalid sign, original = " + originalSignature +
- " current = " + currentSignature);
+ throw new IllegalArgumentException("Invalid sign");
}
return rawValue;
}
--
2.43.0