[HBASE-17561] table status page should escape values that may contain arbitrary characters.

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0, 1.3.1, 1.2.5, 1.1.10, 2.0.0
• Component/s: master, UI
• Assignee: Sean Busbey
• Reporter: Sean Busbey
• Created: 27/Jan/17 19:40
• Updated: 09/Nov/17 19:04
• Resolved: 22/Feb/17 07:51

Description

We write out table names to an html document without escaping html entities

e.g. in this case it even comes directly from the request

    <meta charset="utf-8">
    <% if ( !readOnly && action != null ) { %>
        <title>HBase Master: <%= master.getServerName() %></title>
    <% } else { %>
        <title>Table: <%= fqtn %></title>
    <% } %>

in https://github.com/apache/hbase/blob/master/hbase-server/src/main/resources/hbase-webapps/master/table.jsp