You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sentry.apache.org by sp...@apache.org on 2018/01/12 22:29:16 UTC
sentry git commit: SENTRY-2120: Escape input string for error
response message in LogLevelServlet (Na Li, reviewed by Colm O hEigeartaigh,
Sergio Pena)
Repository: sentry
Updated Branches:
refs/heads/master 6b644c97a -> 6cfd35716
SENTRY-2120: Escape input string for error response message in LogLevelServlet (Na Li, reviewed by Colm O hEigeartaigh, Sergio Pena)
Project: http://git-wip-us.apache.org/repos/asf/sentry/repo
Commit: http://git-wip-us.apache.org/repos/asf/sentry/commit/6cfd3571
Tree: http://git-wip-us.apache.org/repos/asf/sentry/tree/6cfd3571
Diff: http://git-wip-us.apache.org/repos/asf/sentry/diff/6cfd3571
Branch: refs/heads/master
Commit: 6cfd35716fbfb89e014692414103b353b7ee2c49
Parents: 6b644c9
Author: Sergio Pena <se...@cloudera.com>
Authored: Fri Jan 12 16:22:21 2018 -0600
Committer: Sergio Pena <se...@cloudera.com>
Committed: Fri Jan 12 16:22:57 2018 -0600
----------------------------------------------------------------------
.../sentry/provider/db/service/thrift/LogLevelServlet.java | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/sentry/blob/6cfd3571/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/service/thrift/LogLevelServlet.java
----------------------------------------------------------------------
diff --git a/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/service/thrift/LogLevelServlet.java b/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/service/thrift/LogLevelServlet.java
index fce41a8..68d6d90 100644
--- a/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/service/thrift/LogLevelServlet.java
+++ b/sentry-provider/sentry-provider-db/src/main/java/org/apache/sentry/provider/db/service/thrift/LogLevelServlet.java
@@ -107,11 +107,11 @@ public class LogLevelServlet extends HttpServlet {
logInstance.setLevel(Level.toLevel(level));
out.write(String.format(FORMS_SET,
escapeHtml(logName),
- level,
- level,
+ escapeHtml(level),
+ escapeHtml(level),
logInstance.getEffectiveLevel().toString()));
} else {
- response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid log level: " + level);
+ response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid log level: " + escapeHtml(level));
return;
}
}