Details

      Description

      JSON parsing is done using the eval js method in several places in the oozie-console.js, which allows code injection.
      The project already contains a json parser library, which should be used all around the code.
      We are aware that most of the json documents parsed are from the oozie server, and not from the user directly. However fixing it all will make the code most robust and consistent.

        Activity

        Hide
        rkanter Robert Kanter added a comment -

        Closing issue; Oozie 4.3.0 is released.

        Show
        rkanter Robert Kanter added a comment - Closing issue; Oozie 4.3.0 is released.
        Hide
        rkanter Robert Kanter added a comment -

        Thanks Ferenc. Committed to master!

        Show
        rkanter Robert Kanter added a comment - Thanks Ferenc. Committed to master!
        Hide
        rkanter Robert Kanter added a comment -

        +1

        Show
        rkanter Robert Kanter added a comment - +1
        Hide
        satishsaley Satish Subhashrao Saley added a comment -

        +1

        Show
        satishsaley Satish Subhashrao Saley added a comment - +1
        Hide
        fdenes Ferenc Denes added a comment -

        Test cases are not related.
        I have checked the GUI manually (as lack of unit tests) and saw it working with the new js.

        Show
        fdenes Ferenc Denes added a comment - Test cases are not related. I have checked the GUI manually (as lack of unit tests) and saw it working with the new js.
        Hide
        hadoopqa Hadoop QA added a comment -

        Testing JIRA OOZIE-2492

        Cleaning local git workspace

        ----------------------------

        +1 PATCH_APPLIES
        +1 CLEAN
        -1 RAW_PATCH_ANALYSIS
        . +1 the patch does not introduce any @author tags
        . +1 the patch does not introduce any tabs
        . +1 the patch does not introduce any trailing spaces
        . +1 the patch does not introduce any line longer than 132
        . -1 the patch does not add/modify any testcase
        +1 RAT
        . +1 the patch does not seem to introduce new RAT warnings
        +1 JAVADOC
        . +1 the patch does not seem to introduce new Javadoc warnings
        +1 COMPILE
        . +1 HEAD compiles
        . +1 patch compiles
        . +1 the patch does not seem to introduce new javac warnings
        +1 BACKWARDS_COMPATIBILITY
        . +1 the patch does not change any JPA Entity/Colum/Basic/Lob/Transient annotations
        . +1 the patch does not modify JPA files
        -1 TESTS
        . Tests run: 1768
        . Tests failed: 2
        . Tests errors: 0

        . The patch failed the following testcases:

        . testMaxMatThrottleNotPicked(org.apache.oozie.service.TestCoordMaterializeTriggerService)
        . testNone(org.apache.oozie.command.coord.TestCoordActionInputCheckXCommandNonUTC)

        +1 DISTRO
        . +1 distro tarball builds with the patch

        ----------------------------
        -1 Overall result, please check the reported -1(s)

        The full output of the test-patch run is available at

        . https://builds.apache.org/job/oozie-trunk-precommit-build/2790/

        Show
        hadoopqa Hadoop QA added a comment - Testing JIRA OOZIE-2492 Cleaning local git workspace ---------------------------- +1 PATCH_APPLIES +1 CLEAN -1 RAW_PATCH_ANALYSIS . +1 the patch does not introduce any @author tags . +1 the patch does not introduce any tabs . +1 the patch does not introduce any trailing spaces . +1 the patch does not introduce any line longer than 132 . -1 the patch does not add/modify any testcase +1 RAT . +1 the patch does not seem to introduce new RAT warnings +1 JAVADOC . +1 the patch does not seem to introduce new Javadoc warnings +1 COMPILE . +1 HEAD compiles . +1 patch compiles . +1 the patch does not seem to introduce new javac warnings +1 BACKWARDS_COMPATIBILITY . +1 the patch does not change any JPA Entity/Colum/Basic/Lob/Transient annotations . +1 the patch does not modify JPA files -1 TESTS . Tests run: 1768 . Tests failed: 2 . Tests errors: 0 . The patch failed the following testcases: . testMaxMatThrottleNotPicked(org.apache.oozie.service.TestCoordMaterializeTriggerService) . testNone(org.apache.oozie.command.coord.TestCoordActionInputCheckXCommandNonUTC) +1 DISTRO . +1 distro tarball builds with the patch ---------------------------- -1 Overall result, please check the reported -1(s) The full output of the test-patch run is available at . https://builds.apache.org/job/oozie-trunk-precommit-build/2790/
        Hide
        fdenes Ferenc Denes added a comment -

        Test cases are not related.

        Show
        fdenes Ferenc Denes added a comment - Test cases are not related.
        Hide
        hadoopqa Hadoop QA added a comment -

        Testing JIRA OOZIE-2492

        Cleaning local git workspace

        ----------------------------

        +1 PATCH_APPLIES
        +1 CLEAN
        -1 RAW_PATCH_ANALYSIS
        . +1 the patch does not introduce any @author tags
        . +1 the patch does not introduce any tabs
        . +1 the patch does not introduce any trailing spaces
        . +1 the patch does not introduce any line longer than 132
        . -1 the patch does not add/modify any testcase
        +1 RAT
        . +1 the patch does not seem to introduce new RAT warnings
        +1 JAVADOC
        . +1 the patch does not seem to introduce new Javadoc warnings
        +1 COMPILE
        . +1 HEAD compiles
        . +1 patch compiles
        . +1 the patch does not seem to introduce new javac warnings
        +1 BACKWARDS_COMPATIBILITY
        . +1 the patch does not change any JPA Entity/Colum/Basic/Lob/Transient annotations
        . +1 the patch does not modify JPA files
        -1 TESTS
        . Tests run: 1768
        . Tests failed: 7
        . Tests errors: 2

        . The patch failed the following testcases:

        . testNone(org.apache.oozie.command.coord.TestCoordActionInputCheckXCommand)
        . testIDGeneration(org.apache.oozie.service.TestZKUUIDService)
        . testMain(org.apache.oozie.action.hadoop.TestHiveMain)
        . testPigScript(org.apache.oozie.action.hadoop.TestPigMain)
        . testPig_withNullExternalID(org.apache.oozie.action.hadoop.TestPigMain)
        . testEmbeddedPigWithinPython(org.apache.oozie.action.hadoop.TestPigMain)
        . testPigScript(org.apache.oozie.action.hadoop.TestPigMainWithOldAPI)

        +1 DISTRO
        . +1 distro tarball builds with the patch

        ----------------------------
        -1 Overall result, please check the reported -1(s)

        The full output of the test-patch run is available at

        . https://builds.apache.org/job/oozie-trunk-precommit-build/2784/

        Show
        hadoopqa Hadoop QA added a comment - Testing JIRA OOZIE-2492 Cleaning local git workspace ---------------------------- +1 PATCH_APPLIES +1 CLEAN -1 RAW_PATCH_ANALYSIS . +1 the patch does not introduce any @author tags . +1 the patch does not introduce any tabs . +1 the patch does not introduce any trailing spaces . +1 the patch does not introduce any line longer than 132 . -1 the patch does not add/modify any testcase +1 RAT . +1 the patch does not seem to introduce new RAT warnings +1 JAVADOC . +1 the patch does not seem to introduce new Javadoc warnings +1 COMPILE . +1 HEAD compiles . +1 patch compiles . +1 the patch does not seem to introduce new javac warnings +1 BACKWARDS_COMPATIBILITY . +1 the patch does not change any JPA Entity/Colum/Basic/Lob/Transient annotations . +1 the patch does not modify JPA files -1 TESTS . Tests run: 1768 . Tests failed: 7 . Tests errors: 2 . The patch failed the following testcases: . testNone(org.apache.oozie.command.coord.TestCoordActionInputCheckXCommand) . testIDGeneration(org.apache.oozie.service.TestZKUUIDService) . testMain(org.apache.oozie.action.hadoop.TestHiveMain) . testPigScript(org.apache.oozie.action.hadoop.TestPigMain) . testPig_withNullExternalID(org.apache.oozie.action.hadoop.TestPigMain) . testEmbeddedPigWithinPython(org.apache.oozie.action.hadoop.TestPigMain) . testPigScript(org.apache.oozie.action.hadoop.TestPigMainWithOldAPI) +1 DISTRO . +1 distro tarball builds with the patch ---------------------------- -1 Overall result, please check the reported -1(s) The full output of the test-patch run is available at . https://builds.apache.org/job/oozie-trunk-precommit-build/2784/

          People

          • Assignee:
            fdenes Ferenc Denes
            Reporter:
            fdenes Ferenc Denes
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development