Merge pull request #150 from hluu/master

Prevent XSS in the data viewer and in error message #149
azkaban · Oct 20, 2014 · abd2c66 · abd2c66
2 parents 0f6b8f5 + 5ec6440
commit abd2c66
Show file tree

Hide file tree

Showing 6 changed files with 3 additions and 3 deletions.
diff --git a/extlib/azkaban-common-2.6.1.jar → extlib/azkaban-common-2.6.2.jar b/extlib/azkaban-common-2.6.1.jar → extlib/azkaban-common-2.6.2.jar
diff --git a/extlib/azkaban-execserver-2.6.1.jar b/extlib/azkaban-execserver-2.6.1.jar
diff --git a/extlib/azkaban-execserver-2.6.2.jar b/extlib/azkaban-execserver-2.6.2.jar
diff --git a/extlib/azkaban-webserver-2.6.1.jar → extlib/azkaban-webserver-2.6.2.jar b/extlib/azkaban-webserver-2.6.1.jar → extlib/azkaban-webserver-2.6.2.jar
diff --git a/plugins/reportal/src/azkaban/viewer/reportal/reportaldatapage.vm b/plugins/reportal/src/azkaban/viewer/reportal/reportaldatapage.vm
@@ -171,7 +171,7 @@
       #foreach($line in $file.get("content"))
             <tr>
         #foreach($item in $line)
-              <td>$item</td>
+              <td>$esc.html($item)</td>
         #end
             </tr>
       #end

diff --git a/plugins/reportal/src/azkaban/viewer/reportal/reportaleditpage.vm b/plugins/reportal/src/azkaban/viewer/reportal/reportaleditpage.vm
@@ -91,12 +91,12 @@
                     <br/>
       #end
 
-                    $errorMsg
+                    $esc.html($errorMsg)
     #end
         </div>
   #else
     #if($error_message != "null")
-        <div class="box-error-message">$error_message</div>
+        <div class="box-error-message">$esc.html($error_message)</div>
     #elseif($success_message != "null")
         <div class="box-success-message">$success_message</div>
     #end