[HDFS-6684] HDFS NN and DN JSP pages do not check for script injection.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 2.1.0-beta, 2.2.0, 2.3.0, 2.4.1
• Target Version/s: 2.5.0
• Assignee: Jinghui Wang
• Reporter: Jinghui Wang
• Created: 15/Jul/14 17:54
• Updated: 11/Oct/14 00:19
• Resolved: 11/Oct/14 00:19

Description

Datanode's browseDirectory.jsp is not filtering script injection, able to inject a script with dir parameter using dir=/hadoop'\"/><script>alert(759)</script>.

NameNode's dfsnodelist.sjp is not filtering script injection either. Able to set the sorter/order parameter to "DSC%20onMouseOver=alert(959)//".

Issue Links

• is related to: HDFS-6252 Phase out the old web UI in HDFS