瀏覽代碼

HUE-7526 [frontend] Avoid XSS in the wysiwyg5 editor and fix the binding in Hue 4

Enrico Berti 8 年之前
父節點
當前提交
91a2a79

+ 4 - 1
apps/metastore/src/metastore/static/metastore/js/metastore.model.js

@@ -435,7 +435,7 @@ var MetastoreTable = (function () {
     self.loadingQueries = ko.observable(true);
 
     //TODO: Fetch table comment async and don't set it from python
-    self.comment = ko.observable(options.comment);
+    self.comment = ko.observable(options.comment ? options.comment.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '') : null);
     self.commentWithoutNewLines = ko.pureComputed(function(){
       return self.comment() ? self.comment().replace(/<br\s*[\/]?>/gi, ' ').replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '') : '';
     });
@@ -712,6 +712,9 @@ var MetastoreColumn = (function () {
   function MetastoreColumn(options) {
     var self = this;
     self.table = options.table;
+    if (options.extendedColumn && options.extendedColumn.comment) {
+      options.extendedColumn.comment = options.extendedColumn.comment.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+    }
     ko.mapping.fromJS(options.extendedColumn, {}, self);
 
     self.favourite = ko.observable(false);

+ 8 - 7
apps/metastore/src/metastore/templates/metastore.mako

@@ -45,12 +45,8 @@ ${ commonheader(_("Metastore"), app_name, user, request) | n,unicode }
 <script src="${ static('desktop/ext/js/jquery/plugins/jquery.mousewheel.min.js') }"></script>
 <script src="${ static('desktop/ext/js/selectize.min.js') }"></script>
 <script src="${ static('desktop/ext/js/knockout-sortable.min.js') }"></script>
-<script src="${ static('desktop/js/ko.editable.js') }"></script>
 <script src="${ static('desktop/ext/js/bootstrap-editable.min.js') }"></script>
-<script src="${ static('desktop/ext/js/wysihtml5-0.3.0.min.js') }"></script>
-<script src="${ static('desktop/js/bootstrap-wysihtml5-0.0.2.js') }"></script>
-<script src="${ static('desktop/ext/js/bootstrap-editable.wysihtml5.js') }"></script>
-<script src="${ static('beeswax/js/stats.utils.js') }"></script>
+<script src="${ static('desktop/js/ko.editable.js') }"></script>
 
 ${ assist.assistJSModels() }
 
@@ -69,6 +65,11 @@ ${ assist.assistJSModels() }
 ${ assist.assistPanel() }
 % endif
 
+<script src="${ static('desktop/ext/js/wysihtml5-0.3.0.min.js') }"></script>
+<script src="${ static('desktop/js/bootstrap-wysihtml5-0.0.2.js') }"></script>
+<script src="${ static('desktop/ext/js/bootstrap-editable.wysihtml5.js') }"></script>
+<script src="${ static('beeswax/js/stats.utils.js') }"></script>
+
 <link rel="stylesheet" href="${ static('desktop/ext/css/bootstrap-editable.css') }">
 <link rel="stylesheet" href="${ static('desktop/ext/css/bootstrap-wysihtml5-0.0.2.css') }">
 <link rel="stylesheet" href="${ static('notebook/css/notebook.css') }">
@@ -157,7 +158,7 @@ ${ components.menubar(is_embeddable) }
               <!-- ko ifnot: table.isView() -->
               <div class="show-inactive-on-hover">
               <a class="inactive-action pointer toggle-editable" title="${ _('Edit the comment') }"><i class="fa fa-pencil"></i></a>
-              <span data-bind="editable: comment, editableOptions: {enabled: true, type: 'wysihtml5', toggle: 'manual', skipNewLines: true, toggleElement: '.toggle-editable', placement: 'left', placeholder: '${ _ko('Add a comment...') }', emptytext: '${ _ko('Add a comment...') }', inputclass: 'input-xlarge'}">
+              <span data-bind="editable: comment, editableOptions: { escape: true, enabled: true, type: 'wysihtml5', toggle: 'manual', skipNewLines: true, toggleElement: '.toggle-editable', placement: 'left', placeholder: '${ _ko('Add a comment...') }', emptytext: '${ _ko('Add a comment...') }', inputclass: 'input-xlarge'}">
                 ${ _('Add a comment...') }</span>
               </div>
               <!-- /ko -->
@@ -894,7 +895,7 @@ ${ components.menubar(is_embeddable) }
   <div style="position: relative;" class="show-inactive-on-hover">
     <div style="position:absolute; left: 10px; top: 2px;"><a class="inactive-action pointer toggle-editable" title="${ _('Edit the description') }"><i class="fa fa-pencil vertical-align-top"></i></a></div>
     <div style="margin-left: 25px;" data-bind="toggleOverflow: { height: 24 }">
-      <div style="height: inherit" data-bind="editable: comment, editableOptions: { enabled: true, type: 'wysihtml5', toggle: 'manual', toggleElement: '.toggle-editable', placement: 'bottom', forcePlacement: true, placeholder: '${ _ko('Add a description...') }', emptytext: '${ _ko('No description available') }', inputclass:'input-xlarge', rows: 10 }" class="inline-block">
+      <div style="height: inherit" data-bind="editable: comment, editableOptions: { escape: true, enabled: true, type: 'wysihtml5', toggle: 'manual', toggleElement: '.toggle-editable', placement: 'bottom', forcePlacement: true, placeholder: '${ _ko('Add a description...') }', emptytext: '${ _ko('No description available') }', inputclass:'input-xlarge', rows: 10 }" class="inline-block">
         ${ _('Add a description...') }
       </div>
     </div>

+ 9 - 2
desktop/core/src/desktop/static/desktop/ext/css/bootstrap-editable.css

@@ -1,8 +1,7 @@
-/*! X-editable - v1.4.6
+/*! X-editable - v1.5.1
 * In-place editing with Twitter Bootstrap, jQuery UI or pure jQuery
 * http://github.com/vitalets/x-editable
 * Copyright (c) 2013 Vitaliy Potapov; Licensed MIT */
-
 .editableform {
     margin-bottom: 0; /* overwrites bootstrap margin */
 }
@@ -13,6 +12,14 @@
     line-height: 20px; /* overwriting bootstrap line-height. See #133 */
 }
 
+/*
+  BS3 width:1005 for inputs breaks editable form in popup
+  See: https://github.com/vitalets/x-editable/issues/393
+*/
+.editableform .form-control {
+    width: auto;
+}
+
 .editable-buttons {
    display: inline-block; /* should be inline to take effect of parent's white-space: nowrap */
    vertical-align: top;

File diff suppressed because it is too large
+ 1 - 1
desktop/core/src/desktop/static/desktop/ext/js/bootstrap-editable.min.js


Some files were not shown because too many files changed in this diff