You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-commits@hadoop.apache.org by ji...@apache.org on 2015/05/05 01:43:23 UTC
[19/33] hadoop git commit: YARN-1993. Cross-site scripting
vulnerability in TextView.java. Contributed byKenji Kikushima.
YARN-1993. Cross-site scripting vulnerability in TextView.java. Contributed byKenji Kikushima.
Project: http://git-wip-us.apache.org/repos/asf/hadoop/repo
Commit: http://git-wip-us.apache.org/repos/asf/hadoop/commit/e8d0ee5f
Tree: http://git-wip-us.apache.org/repos/asf/hadoop/tree/e8d0ee5f
Diff: http://git-wip-us.apache.org/repos/asf/hadoop/diff/e8d0ee5f
Branch: refs/heads/HDFS-7240
Commit: e8d0ee5fc9af612d7abc9ab2c201434e7102d092
Parents: 6ae2a0d
Author: Tsuyoshi Ozawa <oz...@apache.org>
Authored: Sun May 3 10:51:17 2015 +0900
Committer: Tsuyoshi Ozawa <oz...@apache.org>
Committed: Sun May 3 10:51:17 2015 +0900
----------------------------------------------------------------------
hadoop-yarn-project/CHANGES.txt | 4 ++++
.../main/java/org/apache/hadoop/yarn/webapp/view/TextView.java | 5 ++++-
2 files changed, 8 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hadoop/blob/e8d0ee5f/hadoop-yarn-project/CHANGES.txt
----------------------------------------------------------------------
diff --git a/hadoop-yarn-project/CHANGES.txt b/hadoop-yarn-project/CHANGES.txt
index 899310e..684efc5 100644
--- a/hadoop-yarn-project/CHANGES.txt
+++ b/hadoop-yarn-project/CHANGES.txt
@@ -293,6 +293,10 @@ Release 2.8.0 - UNRELEASED
YARN-2454. Fix compareTo of variable UNBOUNDED in o.a.h.y.util.resource.Resources.
(Xu Yang via junping_du)
+ YARN-1993. Cross-site scripting vulnerability in TextView.java. (Kenji Kikushima
+ via ozawa)
+
+
Release 2.7.1 - UNRELEASED
INCOMPATIBLE CHANGES
http://git-wip-us.apache.org/repos/asf/hadoop/blob/e8d0ee5f/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java
----------------------------------------------------------------------
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java
index 16efa4e..4983dac 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/java/org/apache/hadoop/yarn/webapp/view/TextView.java
@@ -20,6 +20,7 @@ package org.apache.hadoop.yarn.webapp.view;
import java.io.PrintWriter;
+import org.apache.commons.lang.StringEscapeUtils;
import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.yarn.webapp.View;
@@ -45,7 +46,9 @@ public abstract class TextView extends View {
public void echo(Object... args) {
PrintWriter out = writer();
for (Object s : args) {
- out.print(s);
+ String escapedString = StringEscapeUtils.escapeJavaScript(
+ StringEscapeUtils.escapeHtml(s.toString()));
+ out.print(escapedString);
}
}