(spark) branch branch-4.1 updated: [SPARK-54624][UI] Ensure user name in historypage get escaped

[do...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

dongjoon pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/spark.git


The following commit(s) were added to refs/heads/branch-4.1 by this push:
     new 18dbd67c143b [SPARK-54624][UI] Ensure user name in historypage get escaped
18dbd67c143b is described below

commit 18dbd67c143bfee7b42661d336ab7c2cf3e368f6
Author: Kousuke Saruta <sa...@amazon.co.jp>
AuthorDate: Sat Dec 6 07:16:27 2025 -0800

    [SPARK-54624][UI] Ensure user name in historypage get escaped
    
    ### What changes were proposed in this pull request?
    This PR aims to escape user name displayed in historypage.
    
    ### Why are the changes needed?
    Similar to the issue resolved in #52851, user name should also get escaped because arbitrary user name can be set through the env var `SPARK_USER`.
    
    ### Does this PR introduce _any_ user-facing change?
    No.
    
    ### How was this patch tested?
    User name displayed in historypage is escaped even if the name is like `<script>alert('XSS')</script>`
    
    ### Was this patch authored or co-authored using generative AI tooling?
    No.
    
    Closes #53364 from sarutak/fix-username-xss.
    
    Authored-by: Kousuke Saruta <sa...@amazon.co.jp>
    Signed-off-by: Dongjoon Hyun <do...@apache.org>
    (cherry picked from commit 9f3c6a36d8244d2a1e7951807bd56b2d321c5bcc)
    Signed-off-by: Dongjoon Hyun <do...@apache.org>
---
 core/src/main/resources/org/apache/spark/ui/static/historypage.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/src/main/resources/org/apache/spark/ui/static/historypage.js b/core/src/main/resources/org/apache/spark/ui/static/historypage.js
index d847efa2f7ff..853dfa708ef4 100644
--- a/core/src/main/resources/org/apache/spark/ui/static/historypage.js
+++ b/core/src/main/resources/org/apache/spark/ui/static/historypage.js
@@ -216,7 +216,11 @@ $(document).ready(function() {
             data: 'duration',
             render: (id, type, row) => `<span title="${row.durationMillisec}">${row.duration}</span>`
           },
-          {name: 'user', data: 'sparkUser' },
+          {
+            name: 'user',
+            data: 'sparkUser',
+            render: (name) => escapeHtml(name)
+          },
           {name: 'lastUpdated', data: 'lastUpdated' },
           {
             name: 'eventLog',


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org