Skip to content

Reject submitted jar locations that are not inside the Nimbus inbox - #8980

Open
rzo1 wants to merge 1 commit into
masterfrom
fix/nimbus-submitted-jar-location-check
Open

Reject submitted jar locations that are not inside the Nimbus inbox#8980
rzo1 wants to merge 1 commit into
masterfrom
fix/nimbus-submitted-jar-location-check

Conversation

@rzo1

@rzo1 rzo1 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

submitTopologyWithOpts validated the topology name, conf, blobstore map, worker heap and structure, but never the uploadedJarLocation it passes to setupStormCode, so any path readable by Nimbus was opened and copied into the topology jar blob.

The location is now canonicalised and must resolve strictly inside ServerConfigUtils.masterInbox. Local mode is unaffected, since LocalCluster passes null. Extends NimbusTest.

@rzo1 rzo1 added this to the 3.1.0 milestone Aug 19, 2026
@rzo1 rzo1 self-assigned this Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant