YARN-11923: YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI…

[susheelgupta7]

… TRACE block

Description of PR

How was this patch tested?

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

If an AI tool was used:

• The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

[K0K0V0K]

Thanks @susheelgupta7 for this security upgrade.

I think that if we hardcode these two HTTP methods, it will also affect non-Spark applications and could potentially break some custom YARN applications. For example, what if there is a specific YARN AM that has business logic tied to these trace calls?

What do you think about creating a new configuration list of allowed HTTP methods instead of hardcoding these values? If the list is empty, everything would behave as it does currently; otherwise, the methods would be filtered against the list.

[susheelgupta7]

Thanks @susheelgupta7 for this security upgrade.

I think that if we hardcode these two HTTP methods, it will also affect non-Spark applications and could potentially break some custom YARN applications. For example, what if there is a specific YARN AM that has business logic tied to these trace calls?

What do you think about creating a new configuration list of allowed HTTP methods instead of hardcoding these values? If the list is empty, everything would behave as it does currently; otherwise, the methods would be filtered against the list.

Thanks @K0K0V0K for the review. The custom YARN applications may be impacted. I'll update the implementation to use a configurable approach.

[susheelgupta7]

@slfan1989 Could you help me with this infra issue ??
https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8206/5/

ERROR: Checkout failed
Also:   hudson.remoting.Channel$CallSiteStackTrace: Remote call to hadoop16
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1923)
		at hudson.remoting.UserRequest$ExceptionResponse.retrieve(UserRequest.java:384)
		at hudson.remoting.Channel.call(Channel.java:1112)
		at hudson.FilePath.act(FilePath.java:1228)
		at hudson.FilePath.act(FilePath.java:1217)
		at hudson.FilePath.mkdirs(FilePath.java:1408)
		at PluginClassLoader for git//hudson.plugins.git.GitSCM.createClient(GitSCM.java:843)
		at PluginClassLoader for git//hudson.plugins.git.GitSCM._checkout(GitSCM.java:1299)
		at PluginClassLoader for git//hudson.plugins.git.GitSCM.checkout(GitSCM.java:1277)
		at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep.checkout(SCMStep.java:136)
		at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:101)
		at PluginClassLoader for workflow-scm-step//org.jenkinsci.plugins.workflow.steps.scm.SCMStep$StepExecutionImpl.run(SCMStep.java:88)
		at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
		at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
		at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
		at java.base/java.lang.Thread.run(Thread.java:840)