{"record":{"id":"00edbbd1274d1e7e","repo":"apache/hadoop","slug":"non-alphanumeric-data-found-in-input-aborting","errorCode":null,"errorMessage":"Non-alphanumeric data found in input, aborting.","messagePattern":"Non-alphanumeric data found in input, aborting\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/ProfileOutputServlet.java","lineNumber":85,"sourceCode":"      if (req.getQueryString() != null) {\n        refreshUrl += \"?\" + sanitize(req.getQueryString());\n      }\n      ProfileServlet.setResponseHeader(resp);\n      resp.setHeader(\"Refresh\", REFRESH_PERIOD + \";\" + refreshUrl);\n      resp.getWriter().write(\"This page will be auto-refreshed every \" + REFRESH_PERIOD\n          + \" seconds until the output file is ready. Redirecting to \" + refreshUrl);\n    } else {\n      super.doGet(req, resp);\n    }\n  }\n\n  static String sanitize(String input) {\n    // Basic test to try to avoid any XSS attacks or HTML content showing up.\n    // Duplicates HtmlQuoting a little, but avoid destroying ampersand.\n    if (ALPHA_NUMERIC.matcher(input).matches()) {\n      return input;\n    }\n    throw new RuntimeException(\"Non-alphanumeric data found in input, aborting.\");\n  }\n}\n","sourceCodeStart":67,"sourceCodeEnd":88,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/ProfileOutputServlet.java#L67-L88","documentation":"ProfileOutputServlet (the async-profiler endpoint's output reader) validates the requested output file name with a strict whitelist regex [a-zA-Z0-9%=&.\\-]* before serving. Anything outside that set - slashes, spaces, colons, underscores are not even allowed - triggers RuntimeException('Non-alphanumeric data found in input, aborting.'). The check exists to block path traversal and XSS/HTML injection through the servlet's parameters.","triggerScenarios":"Requesting the async-profiler output with a name parameter containing '/', '\\', ':', '_', or spaces, e.g. /prof-output?name=logs/flame.html or name=my_profile.html; URL-encoding tricks that decode to other characters.","commonSituations":"Profiler UI scripts or curl commands carrying a path-qualified file name; copy-pasted profiler commands from other tools that use underscores in default file names.","solutions":["Pass a bare file name built only from letters, digits, '%', '=', '&', '.', and '-' (e.g. name=flame.html)","Strip path components and disallowed characters on the client before issuing the request","Treat the RuntimeException (HTTP 500) as a 400-class input error and fix the caller, not the server"],"exampleFix":"# before\nGET /prof-output?name=logs/flame.html\n\n# after\nGET /prof-output?name=flame.html","handlingStrategy":"validation","validationCode":"private static final Pattern OK = Pattern.compile(\"[a-zA-Z0-9%=&.\\\\-]*\");\nString safeName(String requested) {\n  String base = requested.substring(requested.lastIndexOf('/') + 1);\n  if (!OK.matcher(base).matches()) {\n    throw new IllegalArgumentException(\"profiler output name has disallowed characters\");\n  }\n  return base;\n}","typeGuard":null,"tryCatchPattern":"try {\n  fetchProfilerOutput(name);\n} catch (RuntimeException e) {\n  if (e.getMessage().contains(\"Non-alphanumeric\")) {\n    // bad request: report 400 to the caller with allowed-character guidance\n  }\n}","preventionTips":["Build profiler output names from a fixed whitelist alphabet on the client","Never send path components or OS file names to the profiler servlet","Note underscores are NOT allowed; prefer dashes"],"tags":["hadoop","profiling","async-profiler","input-validation","xss"],"backgroundTag":"input-sanitization-rejected","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}