TEZ-4741: ProfileOutputServlet: require instrumentation ACL to read profiler output

Author: Aggarwal-Raghav

tez-common/src/main/java/org/apache/tez/common/web/ProfileOutputServlet.java

@@ -29,6 +29,7 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.apache.hadoop.http.HttpServer2;
 import org.apache.hadoop.yarn.webapp.MimeType;
 
 import org.eclipse.jetty.servlet.DefaultServlet;
@@ -40,6 +41,11 @@ public class ProfileOutputServlet extends DefaultServlet {
   public static final String FILE_QUERY_PARAM = "file";
 
   public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+    if (!HttpServer2.isInstrumentationAccessAllowed(this.getServletContext(), request, response)) {
+      response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+      writeMessage(response, ProfileServlet.ACCESS_DENIED_MESSAGE);
+      return;
+    }
     String queriedFile = request.getParameter(FILE_QUERY_PARAM);
     if (queriedFile == null) {
       writeMessage(response, "Run the profiler to be able to receive its output");

tez-common/src/main/java/org/apache/tez/common/web/ProfileServlet.java

@@ -99,6 +99,8 @@ public class ProfileServlet extends HttpServlet {
   private static final String ALLOWED_METHODS = "GET";
   private static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
   private static final String CONTENT_TYPE_TEXT = "text/plain; charset=utf-8";
+
+  public static final String ACCESS_DENIED_MESSAGE = "Unauthorized: Instrumentation access is not allowed!";
   private static final String ASYNC_PROFILER_HOME_ENV = "ASYNC_PROFILER_HOME";
   private static final String ASYNC_PROFILER_HOME_SYSTEM_PROPERTY = "async.profiler.home";
   private static final int DEFAULT_DURATION_SECONDS = 10;
@@ -165,7 +167,7 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) thro
     if (!HttpServer2.isInstrumentationAccessAllowed(this.getServletContext(), request, response)) {
       response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
       setResponseHeader(response);
-      out.println("Unauthorized: Instrumentation access is not allowed!");
+      out.println(ACCESS_DENIED_MESSAGE);
       out.close();
       return;
     }