[Grub-dev] C# Grubng 0.1 and few questions
seth
seth at untethered.org
Mon Jan 28 06:55:23 UTC 2008
>
> The first script that accepted .arc.gz files from users was written
> very quickly. All the script did was store these files to disk; later
> we were going to parse out the content, verify hashes, stuff like
> that. So really all a 200 response from PUTing told you was: our
> disks worked :)
Since it was hinted at and admitted that we weren't yet checking the
hash value at upload I decided it might be a good idea to plug that
hole. Spent the last few hours digging around on our various servers
and found jer's scripts that generate the work units. The script that
accepts the completed work units is now checking the hash values and
will not accept the file unless they correct. I was hoping that Jer
would write this code as I don't trust my code well enough to properly
identify real work vs somebody trying to upload unwanted data, but the
other option was to leave open a potential security hole.
So, if your client starts getting 401 errors after posting the file
this is because your hash values don't check out. Make sure that your
client is returning the URLs in the arc file in the same order they
were given to you in the work unit and that you are not modifying the
URLs or hostnames. Oh, and they have to be uploaded by the same user
who downloaded them.
If you're really sure that you're doing all the above correctly and
still getting 401 errors. Ping me or find me in the chat room and
I'll see if I can help.
The script has also been updated so that most errors related to
loading data into hbase will return a 202 return code (vs the normal
200) and an error message describing the the arc file was saved but
not fully processed.
seth
More information about the Grub-dev
mailing list