HTTP Headers server side validation

[kevintang2022]

Description

Headers X-Presto-Catalog, X-Presto-Schema, X-Presto-Source accept any form of input string. This change will filter out special characters. This is significant because the user input is rendered as HTML on the admin page panel.

Motivation and Context

Impact

Addresses ticket T131500431

Test Plan

• Unit tests for HTTP Request session context
• Manual testing by viewing the displayed text in the admin panel

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

General Changes
* ... :pr:`12345`
* ... :pr:`12345`

Hive Connector Changes
* ... :pr:`12345`
* ... :pr:`12345`

If release note is NOT required, use:

== NO RELEASE NOTE ==

[rschlussel]

I think the task was about validating the input, not filtering how it gets displayed. If we are rendering the string in a way that makes it not become executable code, i'm not sure why it matters if there are special characters.

[kevintang2022]

I think the task was about validating the input, not filtering how it gets displayed. If we are rendering the string in a way that makes it not become executable code, i'm not sure why it matters if there are special characters.

"Validating the input" . What would this mean? If we receive some headers that have special characters, should we drop the request then?

[rschlussel]

I think the task was about validating the input, not filtering how it gets displayed. If we are rendering the string in a way that makes it not become executable code, i'm not sure why it matters if there are special characters.

"Validating the input" . What would this mean? If we receive some headers that have special characters, should we drop the request then?

I guess so, though i'm not sure we restrict what characters can be used in a catalog name, so not sure any of these are invalid input. Maybe let's hold off on this for now. I'm not sure there's a real security risk here, as long as we handle these properly.