[OOZIE-2492] JSON security issue in js code

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.1.0
• Fix Version/s: 4.3.0
• Component/s: client, security
• Labels: security web-console
• Assignee: Ferenc Denes
• Reporter: Ferenc Denes
• Created: 23/Mar/16 11:10
• Updated: 02/Dec/16 21:04
• Resolved: 30/Mar/16 00:25

Description

JSON parsing is done using the eval js method in several places in the oozie-console.js, which allows code injection.
The project already contains a json parser library, which should be used all around the code.
We are aware that most of the json documents parsed are from the oozie server, and not from the user directly. However fixing it all will make the code most robust and consistent.