[FLINK-35532] Prevent Cross-Site Authentication (XSA) attacks on Flink dashboard

• Type: Technical Debt
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.19.0
• Fix Version/s: 1.20.0, 1.19.1
• Component/s: Runtime / Web Frontend
• Labels: pull-request-available
• Assignee: Hong Liang Teoh
• Reporter: Hong Liang Teoh
• Created: 05/Jun/24 16:08
• Updated: 06/Jun/24 10:38
• Resolved: 06/Jun/24 10:38

Description

As part of FLINK-33325, we introduced a new tab on the Flink dashboard to trigger the async profiler on the JobManager and TaskManager.

 

The HTML component introduced links out to async profiler page on Github -> https://github.com/async-profiler/async-profiler/wiki.

However, the anchor element introduced does not follow best practices around preventing XSA attacks, by setting up the below:

target="_blank" rel="noopener noreferrer"

We should add these attributes as best practice!

Issue Links

• links to: GitHub Pull Request #24897
• links to: GitHub Pull Request #24903