Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Message-ID: <467649514.1253224919152.JavaMail.jira@brutus>
Date: Thu, 17 Sep 2009 15:01:59 -0700 (PDT)
From: "Owen O'Malley (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Subject: [jira] Updated: (HADOOP-6151) The servlets should quote html
 characters
In-Reply-To: <2103411870.1247675174858.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/HADOOP-6151?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Owen O'Malley updated HADOOP-6151:
----------------------------------

    Attachment: h6151.patch

This patch introduces an input filter for all of the servlets and jsp pages that quotes all of the html active characters in the parameters. This means that all of the cross site scripting attacks based on bad urls should be fixed.

I'll file a follow up jira to fix the vector where the values in the job need to be quoted.

> The servlets should quote html characters
> -----------------------------------------
>
>                 Key: HADOOP-6151
>                 URL: https://issues.apache.org/jira/browse/HADOOP-6151
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>            Reporter: Owen O'Malley
>            Priority: Critical
>             Fix For: 0.21.0
>
>         Attachments: h6151.patch
>
>
> We need to quote html characters that come from user generated data. Otherwise, all of the web ui's have cross site scripting attack, etc.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.