Netflix / genie

Distributed Big Data Orchestration Service
https://netflix.github.io/genie
Apache License 2.0
1.7k stars 365 forks source link

Add sanity check on attachment filename #1212

Closed bhou2 closed 2 months ago

bhou2 commented 2 months ago

When using the local filesystem to store the job attachments, the attachment filename should not contain '/' as this allows saving and potentially executing files at any path of the genie server. To avoid this security issue, we reject the attachment if its filename is illegal, i.e., containing '/'.