Repository navigation
Conversation
Forward local ports to apps in a sandbox: each -L LOCAL:REMOTE serves http://127.0.0.1:LOCAL and relays HTTP and WebSocket traffic through the workspace's /sandbox-proxy/sandboxes/<id>/ports/<port>/ route with the caller's credentials. Forwards accept only localhost-addressed requests and refuse dot-segment paths, so neither a DNS-rebinding page nor a crafted path can use those credentials outside the port route. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
Thanks for the contribution! This pull request was opened from a fork. If you're a member of the Databricks organization, please request access to the If you're an external contributor, no action is needed; a maintainer will review your pull request. |
…oxes Refuse browser requests from other sites (Origin, Sec-Fetch-Site) so a web page can't use a forward, including over WebSockets. Reject remote ports outside 10000-65535 at parse time, start a stopped sandbox before forwarding like `sandbox ssh`, also serve the IPv6 loopback, and keep net/http's error reports in the debug log. Co-authored-by: Isaac <no-reply@databricks.com>
Contributor
|
An authorized user can trigger integration tests manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
|
Superseded by #7395, opened from a branch in this repo. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Add
databricks sandbox port-forward [sandbox-id] -L LOCAL:REMOTE.... Each-Lserveshttp://127.0.0.1:LOCALand relays HTTP and WebSocket traffic to the app on sandbox portREMOTEthrough the workspace's/sandbox-proxy/sandboxes/<id>/ports/<port>/route, authenticated as the caller. Without an ID it uses the default sandbox.Every forwarded request carries the caller's credentials, so a forward:
localhost;OriginandSec-Fetch-Site), so neither a DNS-rebinding page nor a page on another site can use it, including over WebSockets;AuthorizationandX-Databricks-*headers with the CLI's;.or..segments, which the workspace would resolve outside the port route.Remote ports outside 10000-65535 are rejected up front, and a stopped sandbox is started before forwarding, like
sandbox ssh.Why
Users can open apps running in their sandbox without setting up SSH. This is the CLI counterpart of the Python SDK's
SandboxExt.port_forward. Like the rest ofdatabricks sandbox, the command is hidden, so there is no changelog entry.Tests
-Lparsing, the request rewrite and its guards, WebSocket relay, auth failures, and sandbox resolution. Acceptance tests for argument and lookup errors.This pull request and its description were written by Isaac.