[HOTFIX] Avoid shell evaluation of interpreter launch arguments - #5429
Open
jongyoul wants to merge 1 commit into
Open
[HOTFIX] Avoid shell evaluation of interpreter launch arguments#5429jongyoul wants to merge 1 commit into
jongyoul wants to merge 1 commit into
Conversation
jongyoul
marked this pull request as ready for review
August 19, 2026 08:23
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Hardens interpreter launch behavior by eliminating shell evaluation when executing the dependency downloader and by rejecting environment-variable-style %conf overrides when user impersonation is enabled.
Changes:
- Execute the downloader command via an argument array (no
eval) to keep configured values literal. - Add validation in
%confinterpreters to reject env-var-style keys when impersonation is enabled, preventing partial application. - Add regression/unit tests covering literal argument handling and override rejection/allowance.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/launcher/InterpreterShellScriptTest.java | Adds shell-level regression test ensuring downloader args are not shell-evaluated. |
| zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/SessionConfInterpreterTest.java | Extends session conf tests to cover env-var overrides and impersonation rejection. |
| zeppelin-server/src/test/java/org/apache/zeppelin/interpreter/ConfInterpreterTest.java | Adds %conf tests for env-var override rejection/allowance based on impersonation. |
| zeppelin-server/src/main/java/org/apache/zeppelin/interpreter/SessionConfInterpreter.java | Adds validation hook before applying session-scoped property updates. |
| zeppelin-server/src/main/java/org/apache/zeppelin/interpreter/ConfInterpreter.java | Introduces env-var override validation in impersonation mode with error result. |
| bin/interpreter.sh | Removes eval and executes downloader via array arguments; improves quoting for repo dir creation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @Test | ||
| void doesNotEvaluateDownloaderArguments( | ||
| @TempDir Path temporaryDirectory) throws Exception { | ||
| Path zeppelinHome = Paths.get("..").toAbsolutePath().normalize(); |
Comment on lines
+34
to
+46
|
|
||
| class InterpreterShellScriptTest { | ||
|
|
||
| @Test | ||
| void doesNotEvaluateDownloaderArguments( | ||
| @TempDir Path temporaryDirectory) throws Exception { | ||
| Path zeppelinHome = Paths.get("..").toAbsolutePath().normalize(); | ||
| Path javaHome = Files.createDirectories(temporaryDirectory.resolve("java-home/bin")) | ||
| .getParent(); | ||
| Path captureFile = temporaryDirectory.resolve("java-arguments"); | ||
| Path fakeJava = javaHome.resolve("bin/java"); | ||
| Files.writeString(fakeJava, | ||
| "#!/bin/bash\n" |
Comment on lines
+92
to
+100
| return updatedProperties.stringPropertyNames().stream() | ||
| .map(String::trim) | ||
| .filter(RemoteInterpreterUtils::isEnvString) | ||
| .sorted() | ||
| .findFirst() | ||
| .map(environmentVariable -> new InterpreterResult(InterpreterResult.Code.ERROR, | ||
| "Environment variable '" + environmentVariable | ||
| + "' cannot be overridden with %conf when user impersonation is enabled. " | ||
| + "Configure it in the interpreter setting instead.")); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR for?
This PR makes interpreter launch argument handling predictable across configuration and impersonation modes.
The dependency downloader command is now executed directly as an argument array instead of being evaluated as a shell command. Classpath wildcards, spaces, JVM options, and other configured values therefore remain literal process arguments.
When user impersonation is enabled,
%confand session-scoped configuration reject new environment-variable-style overrides. Existing operator-provided interpreter settings remain unchanged, and rejected updates are not partially applied.What type of PR is it?
Hot Fix
Todos
What is the Jira issue?
N/A
How should this be tested?
ZEPPELIN_LOCAL_IP=127.0.0.1 ./mvnw -pl zeppelin-server \ -Dtest=ConfInterpreterTest,SessionConfInterpreterTest,InterpreterShellScriptTest,StandardInterpreterLauncherTest test ./mvnw -pl zeppelin-server -DskipTests -Prat apache-rat:checkThe tests cover literal argument handling for classpaths, wildcards, JVM options, rejected environment overrides with impersonation enabled, allowed updates without impersonation, and preservation of existing operator configuration.
Screenshots (if appropriate)
N/A
Questions: