[HBASE-17558] ZK dumping jsp should escape html

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.4.0, 1.3.1, 1.2.5, 1.1.9, 2.0.0
• Component/s: security, UI
• Assignee: Sean Busbey
• Reporter: Sean Busbey
• Created: 27/Jan/17 19:25
• Updated: 09/Nov/17 19:04
• Resolved: 14/Feb/17 06:14

Description

Right now the ZK status page in the master dumps data from ZK using ZKUtil without doing any processing to e.g. escape HTML entities.

ie.:

        <div class="container-fluid content">
            <div class="row inner_header">
                <div class="page-header">
                    <h1>ZooKeeper Dump</h1>
                </div>
            </div>
            <div class="row">
                <div class="span12">
                    <pre><%= ZKUtil.dump(watcher).trim() %></pre>
                </div>
            </div>
        </div>

current url: https://github.com/apache/hbase/blob/master/hbase-server/src/main/resources/hbase-webapps/master/zk.jsp#L83