[AMBARI-20823] Remove user input from invalid renderer error message

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.5.0
• Fix Version/s: 2.5.1
• Component/s: ambari-server
• Assignee: Attila Magyar
• Reporter: Robert Levas
• Created: 21/Apr/17 20:11
• Updated: 25/Apr/17 22:11
• Resolved: 25/Apr/17 19:36

Description

Remove user input from invalid renderer error message to avoid potential XSS attacks.

The user input data returned in the exception thrown at

org/apache/ambari/server/api/resources/BaseResourceDefinition.java:135

      throw new IllegalArgumentException("Invalid renderer name: " + name +
          " for resource of type: " + m_type);

should be removed and the error message changed to:

Invalid renderer name for resource of type <resource type>.m

or simply

Invalid renderer name.

Issue Links

• links to: review board