hbase-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bus...@apache.org
Subject hbase git commit: HBASE-17561 table status page should escape values that may contain arbitrary characters.
Date Wed, 22 Feb 2017 07:51:03 GMT
Repository: hbase
Updated Branches:
  refs/heads/branch-1.1 7a196b7fb -> 0110bc9d4


HBASE-17561 table status page should escape values that may contain arbitrary characters.

Signed-off-by: Esteban Gutierrez <esteban@apache.org>


Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/0110bc9d
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/0110bc9d
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/0110bc9d

Branch: refs/heads/branch-1.1
Commit: 0110bc9d4ef1aec67dcd8bb1919d4a9a6fefb19d
Parents: 7a196b7
Author: Sean Busbey <busbey@apache.org>
Authored: Thu Feb 9 20:36:58 2017 -0800
Committer: Sean Busbey <busbey@apache.org>
Committed: Wed Feb 22 01:41:18 2017 -0600

----------------------------------------------------------------------
 .../resources/hbase-webapps/master/table.jsp    | 41 ++++++++++++--------
 1 file changed, 24 insertions(+), 17 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/hbase/blob/0110bc9d/hbase-server/src/main/resources/hbase-webapps/master/table.jsp
----------------------------------------------------------------------
diff --git a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp
index 38751d8..9a8e5e4 100644
--- a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp
+++ b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp
@@ -19,8 +19,10 @@
 --%>
 <%@ page contentType="text/html;charset=UTF-8"
   import="static org.apache.commons.lang.StringEscapeUtils.escapeXml"
+  import="java.net.URLEncoder"
   import="java.util.TreeMap"
   import="java.util.Map"
+  import="org.apache.commons.lang.StringEscapeUtils"
   import="org.apache.hadoop.conf.Configuration"
   import="org.apache.hadoop.hbase.client.HTable"
   import="org.apache.hadoop.hbase.client.Admin"
@@ -44,6 +46,7 @@
   Configuration conf = master.getConfiguration();
   MetaTableLocator metaTableLocator = new MetaTableLocator();
   String fqtn = request.getParameter("name");
+  final String escaped_fqtn = StringEscapeUtils.escapeHtml(fqtn);
   HTable table = null;
   String tableHeader;
   boolean withReplica = false;
@@ -67,9 +70,9 @@
   <head>
     <meta charset="utf-8">
     <% if ( !readOnly && action != null ) { %>
-        <title>HBase Master: <%= master.getServerName() %></title>
+        <title>HBase Master: <%= StringEscapeUtils.escapeHtml(master.getServerName().toString())
%></title>
     <% } else { %>
-        <title>Table: <%= fqtn %></title>
+        <title>Table: <%= escaped_fqtn %></title>
     <% } %>
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <meta name="description" content="">
@@ -168,7 +171,7 @@ if ( fqtn != null ) {
 
     <div class="row inner_header">
         <div class="page-header">
-            <h1>Table <small><%= fqtn %></small></h1>
+            <h1>Table <small><%= escaped_fqtn %></small></h1>
         </div>
     </div>
     <div class="row">
@@ -183,12 +186,13 @@ if ( fqtn != null ) {
                             HRegionInfo.FIRST_META_REGIONINFO, j);
     ServerName metaLocation = metaTableLocator.waitMetaRegionLocation(master.getZooKeeper(),
j, 1);
     for (int i = 0; i < 1; i++) {
-      String url = "//" + metaLocation.getHostname() + ":" +
+      // The host name portion should be safe, but I don't know how we handle IDNs so err
on the side of failing safely.
+      String url = "//" + URLEncoder.encode(metaLocation.getHostname()) + ":" +
                    master.getRegionServerInfoPort(metaLocation) + "/";
 %>
 <tr>
   <td><%= escapeXml(meta.getRegionNameAsString()) %></td>
-    <td><a href="<%= url %>"><%= metaLocation.getHostname().toString()
+ ":" + master.getRegionServerInfoPort(metaLocation) %></a></td>
+    <td><a href="<%= url %>"><%= StringEscapeUtils.escapeHtml(metaLocation.getHostname().toString())
+ ":" + master.getRegionServerInfoPort(metaLocation) %></a></td>
     <td><%= escapeXml(Bytes.toString(meta.getStartKey())) %></td>
     <td><%= escapeXml(Bytes.toString(meta.getEndKey())) %></td>
     <td>-</td>
@@ -222,8 +226,10 @@ if ( fqtn != null ) {
 <%= compactionState %>
 <%
   } catch (Exception e) {
-  // Nothing really to do here
-    e.printStackTrace();
+    // Nothing really to do here
+    for(StackTraceElement element : e.getStackTrace()) {
+      %><%= StringEscapeUtils.escapeHtml(element.toString()) %><%
+    }
 %> Unknown <%
   }
 %>
@@ -249,7 +255,6 @@ if ( fqtn != null ) {
     ServerName addr = hriEntry.getValue();
     long req = 0;
     float locality = 0.0f;
-    String urlRegionServer = null;
 
     if (addr != null) {
       ServerLoad sl = master.getServerManager().getLoad(addr);
@@ -269,10 +274,10 @@ if ( fqtn != null ) {
   <td><%= escapeXml(Bytes.toStringBinary(regionInfo.getRegionName())) %></td>
   <%
   if (addr != null) {
-    String url = "//" + addr.getHostname() + ":" + master.getRegionServerInfoPort(addr) +
"/rs-status";
+    String url = "//" + URLEncoder.encode(addr.getHostname()) + ":" + master.getRegionServerInfoPort(addr)
+ "/rs-status";
   %>
   <td>
-     <a href="<%= url %>"><%= addr.getHostname().toString() + ":" + addr.getPort()
%></a>
+     <a href="<%= url %>"><%= StringEscapeUtils.escapeHtml(addr.getHostname().toString())
+ ":" + master.getRegionServerInfoPort(addr) %></a>
   </td>
   <%
   } else {
@@ -298,19 +303,21 @@ if ( fqtn != null ) {
 <h2>Regions by Region Server</h2>
 <table class="table table-striped"><tr><th>Region Server</th><th>Region
Count</th></tr>
 <%
-  for (Map.Entry<ServerName, Integer> rdEntry : regDistribution.entrySet()) {   
-     ServerName addr = rdEntry.getKey();                                       
-     String url = "//" + addr.getHostname() + ":" + master.getRegionServerInfoPort(addr)
+ "/rs-status";
+  for (Map.Entry<ServerName, Integer> rdEntry : regDistribution.entrySet()) {
+     ServerName addr = rdEntry.getKey();
+     String url = "//" + URLEncoder.encode(addr.getHostname()) + ":" + master.getRegionServerInfoPort(addr)
+ "/rs-status";
 %>
 <tr>
-  <td><a href="<%= url %>"><%= addr.getHostname().toString() + ":" +
addr.getPort() %></a></td>
+  <td><a href="<%= url %>"><%= StringEscapeUtils.escapeHtml(addr.getHostname().toString())
+ ":" + master.getRegionServerInfoPort(addr) %></a></td>
   <td><%= rdEntry.getValue()%></td>
 </tr>
 <% } %>
 </table>
 <% }
 } catch(Exception ex) {
-  ex.printStackTrace(System.err);
+  for(StackTraceElement element : ex.getStackTrace()) {
+    %><%= StringEscapeUtils.escapeHtml(element.toString()) %><%
+  }
 } finally {
   admin.close();
 }
@@ -327,7 +334,7 @@ Actions:
 <tr>
   <form method="get">
   <input type="hidden" name="action" value="compact">
-  <input type="hidden" name="name" value="<%= fqtn %>">
+  <input type="hidden" name="name" value="<%= escaped_fqtn %>">
   <td style="border-style: none; text-align: center">
       <input style="font-size: 12pt; width: 10em" type="submit" value="Compact" class="btn"></td>
   <td style="border-style: none" width="5%">&nbsp;</td>
@@ -341,7 +348,7 @@ Actions:
 <tr>
   <form method="get">
   <input type="hidden" name="action" value="split">
-  <input type="hidden" name="name" value="<%= fqtn %>">
+  <input type="hidden" name="name" value="<%= escaped_fqtn %>">
   <td style="border-style: none; text-align: center">
       <input style="font-size: 12pt; width: 10em" type="submit" value="Split" class="btn"></td>
   <td style="border-style: none" width="5%">&nbsp;</td>


Mime
View raw message