[HDFS-13636] Cross-Site Scripting vulnerability in HttpServer2

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0, 3.1.1, 3.0.4
• Hadoop Flags: Reviewed
• Assignee: Haibo Yan
• Reporter: Haibo Yan
• Created: 29/May/18 21:06
• Updated: 01/Jun/18 22:13
• Resolved: 01/Jun/18 21:50

Description

A couple if CSS attack issues were found in our fortify test run.

One of example in hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java

// code placeholder
if (servletContext.getAttribute(ADMINS_ACL) != null &&
!userHasAdministratorAccess(servletContext, remoteUser)) {
response.sendError(HttpServletResponse.SC_FORBIDDEN, "User "
+ remoteUser + " is unauthorized to access this page.");
return false;
}

 

Suggest fix is remove remoteUser from the page, and log it.