Skip to content

[HOTFIX] Avoid shell evaluation of interpreter launch arguments - #5429

Open
jongyoul wants to merge 1 commit into
apache:masterfrom
jongyoul:codex/security-interpreter-eval
Open

[HOTFIX] Avoid shell evaluation of interpreter launch arguments#5429
jongyoul wants to merge 1 commit into
apache:masterfrom
jongyoul:codex/security-interpreter-eval

Conversation

@jongyoul

Copy link
Copy Markdown
Member

What is this PR for?

This PR makes interpreter launch argument handling predictable across configuration and impersonation modes.

The dependency downloader command is now executed directly as an argument array instead of being evaluated as a shell command. Classpath wildcards, spaces, JVM options, and other configured values therefore remain literal process arguments.

When user impersonation is enabled, %conf and session-scoped configuration reject new environment-variable-style overrides. Existing operator-provided interpreter settings remain unchanged, and rejected updates are not partially applied.

What type of PR is it?

Hot Fix

Todos

  • Execute downloader arguments without shell evaluation
  • Preserve classpath and JVM argument behavior
  • Validate user-provided environment overrides in impersonation mode
  • Add unit and shell-level regression tests

What is the Jira issue?

N/A

How should this be tested?

ZEPPELIN_LOCAL_IP=127.0.0.1 ./mvnw -pl zeppelin-server \
  -Dtest=ConfInterpreterTest,SessionConfInterpreterTest,InterpreterShellScriptTest,StandardInterpreterLauncherTest test

./mvnw -pl zeppelin-server -DskipTests -Prat apache-rat:check

The tests cover literal argument handling for classpaths, wildcards, JVM options, rejected environment overrides with impersonation enabled, allowed updates without impersonation, and preservation of existing operator configuration.

Screenshots (if appropriate)

N/A

Questions:

  • Does the license files need to update? No
  • Is there breaking changes for older versions? No
  • Does this needs documentation? No

@jongyoul
jongyoul marked this pull request as ready for review August 19, 2026 08:23
Copilot AI lite review requested due to automatic review settings August 19, 2026 08:23

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Hardens interpreter launch behavior by eliminating shell evaluation when executing the dependency downloader and by rejecting environment-variable-style %conf overrides when user impersonation is enabled.

Changes:

  • Execute the downloader command via an argument array (no eval) to keep configured values literal.
  • Add validation in %conf interpreters to reject env-var-style keys when impersonation is enabled, preventing partial application.
  • Add regression/unit tests covering literal argument handling and override rejection/allowance.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/launcher/InterpreterShellScriptTest.java Adds shell-level regression test ensuring downloader args are not shell-evaluated.
zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/SessionConfInterpreterTest.java Extends session conf tests to cover env-var overrides and impersonation rejection.
zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/ConfInterpreterTest.java Adds %conf tests for env-var override rejection/allowance based on impersonation.
zeppelin-server/src/main/java/org/apache/zeppelin/interpreter/SessionConfInterpreter.java Adds validation hook before applying session-scoped property updates.
zeppelin-server/src/main/java/org/apache/zeppelin/interpreter/ConfInterpreter.java Introduces env-var override validation in impersonation mode with error result.
bin/interpreter.sh Removes eval and executes downloader via array arguments; improves quoting for repo dir creation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@Test
void doesNotEvaluateDownloaderArguments(
@TempDir Path temporaryDirectory) throws Exception {
Path zeppelinHome = Paths.get("..").toAbsolutePath().normalize();
Comment on lines +34 to +46

class InterpreterShellScriptTest {

@Test
void doesNotEvaluateDownloaderArguments(
@TempDir Path temporaryDirectory) throws Exception {
Path zeppelinHome = Paths.get("..").toAbsolutePath().normalize();
Path javaHome = Files.createDirectories(temporaryDirectory.resolve("java-home/bin"))
.getParent();
Path captureFile = temporaryDirectory.resolve("java-arguments");
Path fakeJava = javaHome.resolve("bin/java");
Files.writeString(fakeJava,
"#!/bin/bash\n"
Comment on lines +92 to +100
return updatedProperties.stringPropertyNames().stream()
.map(String::trim)
.filter(RemoteInterpreterUtils::isEnvString)
.sorted()
.findFirst()
.map(environmentVariable -> new InterpreterResult(InterpreterResult.Code.ERROR,
"Environment variable '" + environmentVariable
+ "' cannot be overridden with %conf when user impersonation is enabled. "
+ "Configure it in the interpreter setting instead."));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants