Răsfoiți Sursa

HUE-2345 [beeswax] XSS filter bypass vulnerability

Romain Rigaux 11 ani în urmă
părinte
comite
12f2c1cd55
2 a modificat fișierele cu 30 adăugiri și 2 ștergeri
  1. 29 1
      apps/beeswax/src/beeswax/tests.py
  2. 1 1
      apps/beeswax/src/beeswax/views.py

+ 29 - 1
apps/beeswax/src/beeswax/tests.py

@@ -56,7 +56,7 @@ from beeswax.test_base import make_query, wait_for_query_to_finish, verify_histo
   HIVE_SERVER_TEST_PORT, fetch_query_result_data
 from beeswax.design import hql_query, strip_trailing_semicolon
 from beeswax.data_export import upload, download
-from beeswax.models import SavedQuery, QueryHistory, HQL
+from beeswax.models import SavedQuery, QueryHistory, HQL, HIVE_SERVER2
 from beeswax.server import dbms
 from beeswax.server.dbms import QueryServerException
 from beeswax.server.hive_server2_lib import HiveServerClient,\
@@ -1976,6 +1976,34 @@ class TestWithMockedServer(object):
     assert_equal('test_save_design desc', saved_design.doc.get().description)
     assert_false(saved_design.doc.get().is_historic())
 
+  def test_get_history_xss(self):
+    sql = 'SELECT count(sample_07.salary) FROM sample_07;"><iFrAME>src="javascript:alert(\'Hue has an xss\');"></iFraME>'
+    sql_escaped = 'SELECT count(sample_07.salary) FROM sample_07;&quot;&gt;&lt;iFrAME&gt;src=&quot;javascript:alert(&#39;Hue has an xss&#39;);&quot;&gt;&lt;/iFraME&gt;'
+
+    response = _make_query(self.client, sql, submission_type='Save', name='My Name 1', desc='My Description')
+    content = json.loads(response.content)
+    design_id = content['design_id']
+    design = SavedQuery.objects.get(id=design_id)
+
+    query_history = QueryHistory.build(
+        owner=self.user,
+        query=sql,
+        server_host='server_host',
+        server_port=1,
+        server_name='server_name',
+        server_type=HIVE_SERVER2,
+        last_state=QueryHistory.STATE.submitted.index,
+        design=design,
+        notify=False,
+        query_type=HQL,
+        statement_number=0
+    )
+    query_history.save()
+
+    resp = self.client.get('/beeswax/query_history?format=json')
+    assert_true(sql_escaped in resp.content, resp.content)
+    assert_false(sql in resp.content, resp.content)
+
 
 class TestDesign():
 

+ 1 - 1
apps/beeswax/src/beeswax/views.py

@@ -339,7 +339,7 @@ def list_query_history(request):
 
 def massage_query_history_for_json(app_name, query_history):
   return {
-    'query': query_history.query,
+    'query': escape(query_history.query),
     'timeInMs': time.mktime(query_history.submission_date.timetuple()),
     'timeFormatted': query_history.submission_date.strftime("%x %X"),
     'designUrl': reverse(app_name + ':execute_design', kwargs={'design_id': query_history.design.id}),