You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-issues@hadoop.apache.org by "fanshilun (Jira)" <ji...@apache.org> on 2022/10/07 01:41:00 UTC
[jira] [Commented] (YARN-11331) YARN UIs embed problematic javascript
[ https://issues.apache.org/jira/browse/YARN-11331?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17613834#comment-17613834 ]
fanshilun commented on YARN-11331:
----------------------------------
[~apurtell] Thank you very much for reporting this issue, can you submit a PR to resolve it?
> YARN UIs embed problematic javascript
> -------------------------------------
>
> Key: YARN-11331
> URL: https://issues.apache.org/jira/browse/YARN-11331
> Project: Hadoop YARN
> Issue Type: Bug
> Affects Versions: 3.3.4
> Reporter: Andrew Kyle Purtell
> Priority: Major
>
> YARN component UIs, especially the Application Catalog, embed several problematic Javascript components.
> First and foremost is the Angular framework, for which all development has ceased and several vulnerabilities are known and listed in the CVE database. To fix this requires a migration away from Angular to some other framework.
> Another component like this is x-editable, an editor widget for Bootstrap. There is a cross-site scripting problem for which no fixed version exists. Requires use of an alternative component or addition of a mitigating control.
> All Boostrap versions 3.x have an issue covered by CVE-2018-14041, a cross site scripting problem, fixed in Bootstrap versions 4.1.3 and later. This requires a migration where Bootstrap 3.x is in use to Bootstrap 4.1.3+.
> At my workplace we have chosen to delete the Application Catalog, which I recommend as the most likely path to satisfaction for you as well, because the Angular problem lacks a path forward other than reimplementation.
> x-editable and Bootstrap issues persist in other places.
> Rather than collect these findings piecemeal, it is suggested this issue can be used as an umbrella.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org