Uploaded image for project: 'Apache Airflow'
  1. Apache Airflow
  2. AIRFLOW-6351

security - ui - Add Cross Site Scripting defence

Agile BoardAttach filesAttach ScreenshotVotersWatch issueWatchersLinkUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.10.6, 1.10.7
    • Fix Version/s: 1.10.11
    • Component/s: ui
    • Labels:
      None

      Description

      escape search -->

       

      BEFORE

      return self.render(
      'airflow/dags.html',
      webserver_dags=webserver_dags_filtered,
      orm_dags=orm_dags,
      hide_paused=hide_paused,
      current_page=current_page,
      search_query=arg_search_query if arg_search_query else '',
      page_size=dags_per_page,
      num_of_pages=num_of_pages,
      num_dag_from=start + 1,
      num_dag_to=min(end, num_of_all_dags),
      num_of_all_dags=num_of_all_dags,
      paging=wwwutils.generate_pages(current_page, num_of_pages,
      search=arg_search_query,
      showPaused=not hide_paused),
      dag_ids_in_page=page_dag_ids,
      auto_complete_data=auto_complete_data)

       

      AFTER

      return self.render(
      'airflow/dags.html',
      webserver_dags=webserver_dags_filtered,
      orm_dags=orm_dags,
      hide_paused=hide_paused,
      current_page=current_page,
      search_query=arg_search_query if arg_search_query else '',
      page_size=dags_per_page,
      num_of_pages=num_of_pages,
      num_dag_from=start + 1,
      num_dag_to=min(end, num_of_all_dags),
      num_of_all_dags=num_of_all_dags,
      paging=wwwutils.generate_pages(current_page, num_of_pages,
      search=escape(arg_search_query) if arg_search_query else None,
      showPaused=not hide_paused),
      dag_ids_in_page=page_dag_ids,
      auto_complete_data=auto_complete_data)

       

      https://github.com/apache/airflow/blob/v1-10-stable/airflow/www/views.py#L2278

       

        Attachments

          Activity

            People

              Dates

              • Created:
                Updated:
                Resolved:

                Issue deployment