You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "dongjoon-hyun (via GitHub)" <gi...@apache.org> on 2026/07/15 22:53:18 UTC
[PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
dongjoon-hyun opened a new pull request, #57290:
URL: https://github.com/apache/spark/pull/57290
### What changes were proposed in this pull request?
Escape the executor removal reason in `executorspage.js` by reusing the existing
`escapeHtml` helper from `utils.js`.
`formatLossReason` is the DataTables `render` callback for the `removeReason`
column and returned the value unchanged. DataTables assigns the `render` output
to the cell's `innerHTML`, so the reason was parsed as markup.
This is a follow-up to SPARK-58156, which fixed the timeline tooltip surface of
the same field. `executorspage.js` was out of scope there.
### Why are the changes needed?
The removal reason carries strings that originate outside the driver: executor-side
exception messages via `CoarseGrainedExecutorBackend`, YARN container diagnostics,
K8s pod status messages, and Standalone worker exceptions. They converge on
`ExecutorLossReason.message` and reach the UI through
`SparkListenerExecutorRemoved`.
A reason such as `"><img src=x onerror=alert(1)>` injects a tag into the Executors
table. The default CSP set by `HttpSecurityFilter` blocks the inline handler from
running, so this is defense-in-depth rather than a directly exploitable XSS. It
still matters when CSP is disabled, and because the reason is persisted to the
event log and replayed by the History Server, which may render one user's
application to an administrator.
### Does this PR introduce _any_ user-facing change?
Yes. In the Executors page, a removal reason containing HTML metacharacters is now
displayed literally as text instead of being interpreted as markup. Other reasons
are unaffected.
### How was this patch tested?
Added `ui-test/tests/executorspage.test.js`: a unit test on `formatLossReason`, and
an integration test that drives the real bundled DataTables and asserts no element
is injected into the cell. Both fail when the escaping is reverted.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57290:
URL: https://github.com/apache/spark/pull/57290#issuecomment-4992278876
**Merge Summary:**
- merged into master https://github.com/apache/spark/commit/00b61a740ed1c3279ef54de4662f6c0309e68818
- merged into branch-4.x https://github.com/apache/spark/commit/cf5f9afad8c148b9064187191ff67cc17e80d2bb
- merged into branch-4.2 https://github.com/apache/spark/commit/67248eefe25baac7785a839fbd2100d98bec82ad
- merged into branch-4.1 https://github.com/apache/spark/commit/e7739bfcdf173d1d67e2711972b4275e501fe3fb
- merged into branch-4.0 https://github.com/apache/spark/commit/deffa026fc4dfde697ffa168434a0cf04ecf7764
*Posted by `merge_spark_pr.py`*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57290:
URL: https://github.com/apache/spark/pull/57290#issuecomment-4992238071
Thank you, @peter-toth !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57290:
URL: https://github.com/apache/spark/pull/57290#issuecomment-4986053132
Could you review this PR when you have some time, @yaooqinn ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57290:
URL: https://github.com/apache/spark/pull/57290#issuecomment-4986087171
Thank you, @HyukjinKwon !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun commented on PR #57290:
URL: https://github.com/apache/spark/pull/57290#issuecomment-4992357696
I backported this to branch-3.5 via https://github.com/apache/spark/commit/71d3aca6b37ae5446538e5304bb420172a18dd11 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org
Re: [PR] [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js` [spark]
Posted by "dongjoon-hyun (via GitHub)" <gi...@apache.org>.
dongjoon-hyun closed pull request #57290: [SPARK-58158][CORE][UI] Escape the executor removal reason in `executorspage.js`
URL: https://github.com/apache/spark/pull/57290
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org