[HDFS-4162] Some malformed and unquoted HTML strings are returned from datanode web ui

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.23.4
• Fix Version/s: 2.0.3-alpha, 0.23.5
• Component/s: datanode
• Target Version/s: 2.0.3-alpha, 0.23.5
• Hadoop Flags: Reviewed
• Assignee: Derek Dagit
• Reporter: Derek Dagit
• Created: 07/Nov/12 22:17
• Updated: 03/Sep/14 23:19
• Resolved: 09/Nov/12 17:42

Description

When browsing to the datanode at /browseDirectory.jsp, if a path with HTML characters is requested, the resulting error page echos back the input unquoted.

Example:

http://localhost:50075/browseDirectory.jsp?dir=/<xss>&go=go&namenodeInfoPort=50070&nnaddr=localhost%3A9000

Writes an input element as part of the response:

<input name="dir" type="text" width="50" id"dir" value="/<xss>">

• The value of the "value" attribute is not quoted.
• An = must follow the "id" attribute name.
• Element "input" should have a closing tag.

The output should be something like:

<input name="dir" type="text" width="50" id="dir" value="/<xss>"/>

In addition, if one creates a directory:

hdfs dfs -put '/some/path/to/<xss>'

Then browsing to the parent of directory '<xss>' prints unquoted HTML in the directory names.