[YARN-1993] Cross-site scripting vulnerability in TextView.java

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: webapp
• Target Version/s: 2.8.0
• Hadoop Flags: Reviewed
• Assignee: Kenji Kikushima
• Reporter: Ted Yu
• Created: 28/Apr/14 17:07
• Updated: 30/Aug/16 01:31
• Resolved: 03/May/15 01:53

Description

In hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java , method echo() e.g. :

    for (Object s : args) {
      out.print(s);
    }

Printing s to an HTML page allows cross-site scripting, because it was not properly sanitized for context HTML attribute name.

Issue Links

• is related to: YARN-3589 RM and AH web UI display DOCTYPE wrongly