-
- Downloads
[SPARK-20393][WEBU UI] Strengthen Spark to prevent XSS vulnerabilities
## What changes were proposed in this pull request? Add stripXSS and stripXSSMap to Spark Core's UIUtils. Calling these functions at any point that getParameter is called against a HttpServletRequest. ## How was this patch tested? Unit tests, IBM Security AppScan Standard no longer showing vulnerabilities, manual verification of WebUI pages. Author: NICHOLAS T. MARION <nmarion@us.ibm.com> Closes #17686 from n-marion/xss-fix.
Showing
- core/src/main/scala/org/apache/spark/deploy/history/HistoryPage.scala 2 additions, 1 deletion...n/scala/org/apache/spark/deploy/history/HistoryPage.scala
- core/src/main/scala/org/apache/spark/deploy/master/ui/ApplicationPage.scala 2 additions, 1 deletion...a/org/apache/spark/deploy/master/ui/ApplicationPage.scala
- core/src/main/scala/org/apache/spark/deploy/master/ui/MasterPage.scala 4 additions, 2 deletions.../scala/org/apache/spark/deploy/master/ui/MasterPage.scala
- core/src/main/scala/org/apache/spark/deploy/worker/ui/LogPage.scala 18 additions, 12 deletions...ain/scala/org/apache/spark/deploy/worker/ui/LogPage.scala
- core/src/main/scala/org/apache/spark/ui/UIUtils.scala 21 additions, 0 deletionscore/src/main/scala/org/apache/spark/ui/UIUtils.scala
- core/src/main/scala/org/apache/spark/ui/exec/ExecutorThreadDumpPage.scala 3 additions, 1 deletion...ala/org/apache/spark/ui/exec/ExecutorThreadDumpPage.scala
- core/src/main/scala/org/apache/spark/ui/jobs/AllJobsPage.scala 8 additions, 6 deletions...src/main/scala/org/apache/spark/ui/jobs/AllJobsPage.scala
- core/src/main/scala/org/apache/spark/ui/jobs/JobPage.scala 2 additions, 1 deletioncore/src/main/scala/org/apache/spark/ui/jobs/JobPage.scala
- core/src/main/scala/org/apache/spark/ui/jobs/JobsTab.scala 3 additions, 2 deletionscore/src/main/scala/org/apache/spark/ui/jobs/JobsTab.scala
- core/src/main/scala/org/apache/spark/ui/jobs/PoolPage.scala 2 additions, 1 deletioncore/src/main/scala/org/apache/spark/ui/jobs/PoolPage.scala
- core/src/main/scala/org/apache/spark/ui/jobs/StagePage.scala 8 additions, 7 deletionscore/src/main/scala/org/apache/spark/ui/jobs/StagePage.scala
- core/src/main/scala/org/apache/spark/ui/jobs/StageTable.scala 8 additions, 7 deletions.../src/main/scala/org/apache/spark/ui/jobs/StageTable.scala
- core/src/main/scala/org/apache/spark/ui/jobs/StagesTab.scala 3 additions, 2 deletionscore/src/main/scala/org/apache/spark/ui/jobs/StagesTab.scala
- core/src/main/scala/org/apache/spark/ui/storage/RDDPage.scala 7 additions, 6 deletions.../src/main/scala/org/apache/spark/ui/storage/RDDPage.scala
- core/src/test/scala/org/apache/spark/ui/UIUtilsSuite.scala 39 additions, 0 deletionscore/src/test/scala/org/apache/spark/ui/UIUtilsSuite.scala
- resource-managers/mesos/src/main/scala/org/apache/spark/deploy/mesos/ui/DriverPage.scala 2 additions, 1 deletion...n/scala/org/apache/spark/deploy/mesos/ui/DriverPage.scala
- sql/core/src/main/scala/org/apache/spark/sql/execution/ui/ExecutionPage.scala 2 additions, 1 deletion...ala/org/apache/spark/sql/execution/ui/ExecutionPage.scala
- sql/hive-thriftserver/src/main/scala/org/apache/spark/sql/hive/thriftserver/ui/ThriftServerSessionPage.scala 2 additions, 2 deletions...rk/sql/hive/thriftserver/ui/ThriftServerSessionPage.scala
- streaming/src/main/scala/org/apache/spark/streaming/ui/BatchPage.scala 4 additions, 1 deletion.../main/scala/org/apache/spark/streaming/ui/BatchPage.scala
Loading
Please register or sign in to comment