Skip to content

[SPARK-20393][WEBU UI][1.6] Strengthen Spark to prevent XSS vulnerabilities #19528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ambauma wants to merge 6 commits into from
Closed

[SPARK-20393][WEBU UI][1.6] Strengthen Spark to prevent XSS vulnerabilities #19528

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d9a45aa
Initial Merge of SPARK-20393 to 1.6 branch
n-marion May 10, 2017
630854a
Removing what I believe is extra code never intended for the Spark 1.…
ambauma Oct 10, 2017
ffe3e98
Adding back in DriverPage.scala
ambauma Oct 10, 2017
cafe18d
Added missing XSS strip based on comparison to 2.0 branch.
ambauma Oct 19, 2017
cb1609b
[SPARK-20862][MLLIB][PYTHON] Avoid passing float to ndarray.reshape i…
MrBago May 24, 2017
76ad8c5
Changes based on comments.
ambauma Oct 21, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Added missing XSS strip based on comparison to 2.0 branch.
  • Loading branch information
@ambauma
ambauma committed Oct 19, 2017
commit cafe18d30ca2c070f7a70e087e8b446d2bdaa62b
3 changes: 2 additions & 1 deletion core/src/main/scala/org/apache/spark/ui/jobs/StagesTab.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ private[ui] class StagesTab(parent: SparkUI) extends SparkUITab(parent, "stages"

def handleKillRequest(request: HttpServletRequest): Unit = {
if (killEnabled && parent.securityManager.checkModifyPermissions(request.getRemoteUser)) {
val killFlag = Option(request.getParameter("terminate")).getOrElse("false").toBoolean
val killFlag = Option(UIUtils.stripXSS(request.getParameter("terminate")))
.getOrElse("false").toBoolean
// stripXSS is called first to remove suspicious characters used in XSS attacks
val stageId = Option(UIUtils.stripXSS(request.getParameter("id"))).getOrElse("-1").toInt
if (stageId >= 0 && killFlag && progressListener.activeStages.contains(stageId)) {
Expand Down