Pārlūkot izejas kodu

HUE-8032 [core] XSS in Hue Admin Interface

Roohi 7 gadi atpakaļ
vecāks
revīzija
a71593e

+ 37 - 0
apps/useradmin/src/useradmin/tests.py

@@ -789,6 +789,43 @@ class TestUserAdmin(BaseUserAdminTests):
     response = client.post('/useradmin/users/edit/test', dict(language='ko'))
     assert_true('<option value="ko" selected="selected">Korean</option>' in response.content)
 
+  def test_edit_user_xss(self):
+    # Hue 3 Admin
+    edit_user = make_logged_in_client('admin', is_superuser=True)
+    response = edit_user.post('/useradmin/users/edit/admin', dict(username="admin",
+                                                                      is_superuser=True,
+                                                                      password1="foo",
+                                                                      password2="foo",
+                                                                      language="en-us><script>alert('Hacked')</script>"
+                                                                      ))
+    assert_true('Select a valid choice. en-us&gt;&lt;script&gt;alert(&#39;Hacked&#39;)&lt;/script&gt; is not one of the available choices.' in response.content)
+    # Hue 4 Admin
+    response = edit_user.post('/useradmin/users/edit/admin', dict(username="admin",
+                                                                      is_superuser=True,
+                                                                      language="en-us><script>alert('Hacked')</script>",
+                                                                      is_embeddable=True))
+    content = json.loads(response.content)
+    assert_true('Select a valid choice. en-us>alert(\'Hacked\') is not one of the available choices.', content['errors'][0]['message'][0])
+
+    # Hue 3, User with access to useradmin app
+    edit_user = make_logged_in_client('edit_user', is_superuser=False)
+    grant_access('edit_user', 'edit_user', 'useradmin')
+    response = edit_user.post('/useradmin/users/edit/edit_user', dict(username="edit_user",
+                                                                      is_superuser=False,
+                                                                      password1="foo",
+                                                                      password2="foo",
+                                                                      language="en-us><script>alert('Hacked')</script>"
+                                                                      ))
+    assert_true('Select a valid choice. en-us&gt;&lt;script&gt;alert(&#39;Hacked&#39;)&lt;/script&gt; is not one of the available choices.' in response.content)
+    # Hue 4, User with access to useradmin app
+    response = edit_user.post('/useradmin/users/edit/edit_user', dict(username="edit_user",
+                                                                      is_superuser=False,
+                                                                      language="en-us><script>alert('Hacked')</script>",
+                                                                      is_embeddable=True))
+    content = json.loads(response.content)
+    assert_true('Select a valid choice. en-us>alert(\'Hacked\') is not one of the available choices.',
+                content['errors'][0]['message'][0])
+
 
 class TestUserAdminWithHadoop(BaseUserAdminTests):
 

+ 2 - 1
apps/useradmin/src/useradmin/views.py

@@ -43,6 +43,7 @@ import desktop.conf
 from desktop.conf import LDAP
 from desktop.lib.django_util import JsonResponse, render
 from desktop.lib.exceptions_renderable import PopupException
+from desktop.views import antixss
 
 from hadoop.fs.exceptions import WebHdfsException
 from useradmin.models import HuePermission, UserProfile, LdapGroup
@@ -395,7 +396,7 @@ def edit_user(request, username=None):
     })
   else:
     if request.method == 'POST' and is_embeddable:
-      return JsonResponse({'status': -1, 'errors': [{'id': f.id_for_label, 'message': f.errors} for f in form if f.errors]})
+      return JsonResponse({'status': -1, 'errors': [{'id': f.id_for_label, 'message': map(antixss, f.errors)} for f in form if f.errors]})
     else:
       return render('edit_user.mako', request, {
         'form': form,