[
https://issues.apache.org/jira/browse/IMPALA-15219?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18113530#comment-18113530
]
ASF subversion and git services commented on IMPALA-15219:
----------------------------------------------------------
Commit c05d6ad044cce3975ce09c8055c0d2d0e2749571 in impala's branch
refs/heads/master from yida.wu
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=c05d6ad04 ]
IMPALA-15219: (Addendum) Harden AI endpoint URL validation with libcurl
This patch replaces the old, customized substring-based URL parser
with the standard libcurl API for ExtractHost(). Using a standard
library for ExtractHost() is better to prevent most edge-case
bypasses and safety concerns.
Tests:
Added more edge cases in AiFunctionsTest and
AiFunctionsTestAdditionalSites.
Passed core tests.
Change-Id: Id787af79c78ac91099b03cdf587db5d1504e5eb5
Reviewed-on: http://gerrit.cloudera.org:8080/24798
Reviewed-by: Michael Smith <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
> Secrets Exfiltration via SSRF
> -----------------------------
>
> Key: IMPALA-15219
> URL: https://issues.apache.org/jira/browse/IMPALA-15219
> Project: IMPALA
> Issue Type: Bug
> Components: Security
> Reporter: Michael Smith
> Assignee: Michael Smith
> Priority: Major
> Fix For: Impala 5.0.0, Impala 4.5.2
>
>
> https://www.cve.org/CVERecord?id=CVE-2026-57866
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
