Return-Path: 
 <issues-return-9318-apmail-hbase-issues-archive=hbase.apache.org@hbase.apache.org>
Delivered-To: apmail-hbase-issues-archive@www.apache.org
Received: (qmail 25195 invoked from network); 18 Feb 2011 02:01:36 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3)
  by minotaur.apache.org with SMTP; 18 Feb 2011 02:01:36 -0000
Received: (qmail 6518 invoked by uid 500); 18 Feb 2011 02:01:36 -0000
Delivered-To: apmail-hbase-issues-archive@hbase.apache.org
Received: (qmail 6472 invoked by uid 500); 18 Feb 2011 02:01:35 -0000
Mailing-List: contact issues-help@hbase.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@hbase.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@hbase.apache.org>
List-Post: <mailto:issues@hbase.apache.org>
List-Id: <issues.hbase.apache.org>
Delivered-To: mailing list issues@hbase.apache.org
Received: (qmail 6460 invoked by uid 99); 18 Feb 2011 02:01:35 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 18 Feb 2011 02:01:35 +0000
X-ASF-Spam-Status: No, hits=-2000.0 required=5.0
	tests=ALL_TRUSTED,T_RP_MATCHES_RCVD
X-Spam-Check-By: apache.org
Received: from [140.211.11.116] (HELO hel.zones.apache.org) (140.211.11.116)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 18 Feb 2011 02:01:33 +0000
Received: from hel.zones.apache.org (hel.zones.apache.org [140.211.11.116])
	by hel.zones.apache.org (Postfix) with ESMTP id 512881AC6E3
	for <issues@hbase.apache.org>; Fri, 18 Feb 2011 02:01:12 +0000 (UTC)
Date: Fri, 18 Feb 2011 02:01:12 +0000 (UTC)
From: "Takuya Ueshin (JIRA)" <jira@apache.org>
To: issues@hbase.apache.org
Message-ID: 
 <1063513833.867.1297994472329.JavaMail.tomcat@hel.zones.apache.org>
In-Reply-To: 
 <526484107.863.1297994352114.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] Updated: (HBASE-3546) XSS in the WebUI
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
X-Virus-Checked: Checked by ClamAV on apache.org


     [ https://issues.apache.org/jira/browse/HBASE-3546?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Takuya Ueshin updated HBASE-3546:
---------------------------------

    Description: 
There are possibilities of XSS in the WebUI.

If ColumnFamily or Region splitting keys are like

Bytes.toBytes("<script>alert('js')</script>")

then browsers run the JavaScript code.
I tested on HBase-0.90.0 .


  was:
There are possibilities of XSS in the XSS.

If ColumnFamily or Region splitting keys are like

Bytes.toBytes("<script>alert('js')</script>")

then browsers run the JavaScript code.
I tested on HBase-0.90.0 .



> XSS in the WebUI
> ----------------
>
>                 Key: HBASE-3546
>                 URL: https://issues.apache.org/jira/browse/HBASE-3546
>             Project: HBase
>          Issue Type: Bug
>            Reporter: Takuya Ueshin
>            Priority: Minor
>
> There are possibilities of XSS in the WebUI.
> If ColumnFamily or Region splitting keys are like
> Bytes.toBytes("<script>alert('js')</script>")
> then browsers run the JavaScript code.
> I tested on HBase-0.90.0 .

-- 
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira