[SPARK-46893] Remove inline scripts from UI descriptions

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.1
• Fix Version/s: 4.0.0, 3.5.1, 3.4.3
• Component/s: UI, Web UI
• Labels: pull-request-available
• Assignee: Willi Raschkowski
• Reporter: Willi Raschkowski
• Created: 28/Jan/24 17:59
• Updated: 30/Jan/24 06:44
• Resolved: 30/Jan/24 06:43

Description

Users can inject inline scripts (e.g. onclick or onmouseover handlers) in the UI job and stage descriptions.

The UI already has precaution to treat, e.g., <script> tags as plain-text. But that doesn't extend to inline scripts.

Example:

Bad job descriptions

scala> sc.setJobDescription("""<a href="/link" onmouseover="alert('oops');">onmouseover</a>""")

scala> spark.sql("SELECT 1").show()
...

scala> sc.setJobDescription("""<a href="/link" onclick="alert('oops');">onclick</a>""")

scala> spark.sql("SELECT 1").show()
...

Issue Links

• links to: GitHub Pull Request #44933