Эх сурвалжийг харах

HUE-2583 [core] DOM Based XSS

Replaced all location.hash read references
Enrico Berti 10 жил өмнө
parent
commit
db17d179c2

+ 2 - 2
apps/filebrowser/src/filebrowser/templates/listdir_components.mako

@@ -1767,7 +1767,7 @@ from django.utils.translation import ugettext as _
 
       if (location.hash != null && location.hash.length > 1) {
         var targetPath = "";
-        var hash = window.location.hash.substring(1);
+        var hash = window.location.hash.substring(1).replace(/(<([^>]+)>)/ig, "");
         if (hash != null && hash != "") {
           targetPath = "${url('filebrowser.views.view', path=urlencode('/'))}";
           if (hash.indexOf("!!") != 0) {
@@ -1842,7 +1842,7 @@ from django.utils.translation import ugettext as _
 
       $(window).bind("hashchange", function () {
         var targetPath = "";
-        var hash = window.location.hash.substring(1);
+        var hash = window.location.hash.substring(1).replace(/(<([^>]+)>)/ig, "");
 
         if (hash != null && hash != "") {
           addPathToHistory(hash);

+ 1 - 1
apps/jobbrowser/src/jobbrowser/templates/attempt.mako

@@ -188,7 +188,7 @@ ${ comps.menubar() }
     });
 
     if (window.location.hash != null && window.location.hash.length > 1) {
-      $('#tabs a[href="#' + window.location.hash.substring(2) + '"]').tab('show');
+      $('#tabs a[href="#' + window.location.hash.substring(2).replace(/(<([^>]+)>)/ig, "") + '"]').tab('show');
     }
 
     hellipsify();

+ 1 - 1
apps/oozie/src/oozie/templates/dashboard/list_oozie_bundles.mako

@@ -264,7 +264,7 @@ ${layout.menubar(section='bundles', dashboard=True)}
       drawTable();
     });
 
-    var hash = window.location.hash;
+    var hash = window.location.hash.replace(/(<([^>]+)>)/ig, "");
     if (hash != "" && hash.indexOf("=") > -1) {
       $("a.btn-date[data-value='" + hash.split("=")[1] + "']").click();
     }

+ 1 - 1
apps/oozie/src/oozie/templates/dashboard/list_oozie_coordinators.mako

@@ -300,7 +300,7 @@ ${layout.menubar(section='coordinators', dashboard=True)}
       drawTable();
     });
 
-    var hash = window.location.hash;
+    var hash = window.location.hash.replace(/(<([^>]+)>)/ig, "");
     if (hash != "" && hash.indexOf("=") > -1) {
       $("a.btn-date[data-value='" + hash.split("=")[1] + "']").click();
     }

+ 1 - 1
apps/oozie/src/oozie/templates/dashboard/list_oozie_sla.mako

@@ -284,7 +284,7 @@ ${ layout.menubar(section='sla', dashboard=True) }
     });
 
     if (window.location.hash != "") {
-      $("input[name='job_name']").val(window.location.hash.substr(1));
+      $("input[name='job_name']").val(window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, ""));
       performSearch(window.location.hash.substr(1));
     }
   });

+ 1 - 1
apps/oozie/src/oozie/templates/dashboard/list_oozie_workflows.mako

@@ -299,7 +299,7 @@ ${ layout.menubar(section='workflows', dashboard=True) }
       drawTable();
     });
 
-    var hash = window.location.hash;
+    var hash = window.location.hash.replace(/(<([^>]+)>)/ig, "");
     if (hash != "" && hash.indexOf("=") > -1) {
       $("a.btn-date[data-value='" + hash.split("=")[1] + "']").click();
     }

+ 1 - 1
apps/oozie/src/oozie/templates/editor2/bundle_editor.mako

@@ -25,7 +25,7 @@ ${ commonheader(_("Bundle Editor"), "Oozie", user) | n,unicode }
 <script type="text/javascript">
   if (window.location.hash != "") {
     if (window.location.hash.indexOf("bundle") > -1) {
-      location.href = "/oozie/editor/bundle/edit/?" + window.location.hash.substr(1);
+      location.href = "/oozie/editor/bundle/edit/?" + window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
   }
 </script>

+ 1 - 1
apps/oozie/src/oozie/templates/editor2/coordinator_editor.mako

@@ -27,7 +27,7 @@ ${ commonheader(_("Coordinator Editor"), "Oozie", user) | n,unicode }
 <script type="text/javascript">
   if (window.location.hash != "") {
     if (window.location.hash.indexOf("coordinator") > -1) {
-      location.href = "/oozie/editor/coordinator/edit/?" + window.location.hash.substr(1);
+      location.href = "/oozie/editor/coordinator/edit/?" + window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
   }
   var datasetTypeaheadSource = ["/data/${'${'}YEAR}/${'${'}MONTH}/${'${'}DAY}", "${'${'}MINUTE}", "${'${'}HOUR}", "${'${'}DAY}", "${'${'}MONTH}", "${'${'}YEAR}", "${'${'}coord:nominalTime()}", "${'${'}coord:formatTime(coord:nominalTime(), 'yyyyMMdd')}"]

+ 1 - 1
apps/oozie/src/oozie/templates/editor2/workflow_editor.mako

@@ -33,7 +33,7 @@ ${ commonheader(_("Workflow Editor"), "Oozie", user, "40px") | n,unicode }
 <script type="text/javascript">
   if (window.location.hash != "") {
     if (window.location.hash.indexOf("workflow") > -1) {
-      location.href = "/oozie/editor/workflow/edit/?" + window.location.hash.substr(1);
+      location.href = "/oozie/editor/workflow/edit/?" + window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
   }
 </script>

+ 1 - 1
apps/search/src/search/templates/search.mako

@@ -26,7 +26,7 @@ ${ commonheader(_('Search'), "search", user, "80px") | n,unicode }
 <script type="text/javascript">
   if (window.location.hash != "") {
     if (window.location.hash.indexOf("collection") > -1) {
-      location.href = "/search/?" + window.location.hash.substr(1);
+      location.href = "/search/?" + window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
   }
 </script>

+ 1 - 1
apps/security/src/security/templates/hdfs.mako

@@ -309,7 +309,7 @@ ${ tree.import_templates(itemClick='$root.assist.setPath', iconClick='$root.assi
 
     var _initialPath = "/";
     if (window.location.hash != "") {
-      _initialPath = window.location.hash.substr(1);
+      _initialPath = window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
     viewModel.init(_initialPath);
 

+ 4 - 4
apps/security/static/js/hive.ko.js

@@ -1191,7 +1191,7 @@ var HiveViewModel = function (initial) {
   }
 
   self.updatePathHash = function (path) {
-    var _hash = window.location.hash;
+    var _hash = window.location.hash.replace(/(<([^>]+)>)/ig, "");
     if (_hash.indexOf("@") == -1) {
       window.location.hash = path;
     }
@@ -1201,7 +1201,7 @@ var HiveViewModel = function (initial) {
   }
 
   self.updateSectionHash = function (section) {
-    var _hash = window.location.hash;
+    var _hash = window.location.hash.replace(/(<([^>]+)>)/ig, "");
     if (_hash == "") {
       window.location.hash = "@" + section;
     }
@@ -1215,7 +1215,7 @@ var HiveViewModel = function (initial) {
 
   self.getPathHash = function () {
     if (window.location.hash != "") {
-      var _hash = window.location.hash.substr(1);
+      var _hash = window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
       if (_hash.indexOf("@") > -1) {
         return _hash.split("@")[0];
       }
@@ -1228,7 +1228,7 @@ var HiveViewModel = function (initial) {
 
   self.getSectionHash = function () {
     if (window.location.hash != "") {
-      var _hash = window.location.hash.substr(1);
+      var _hash = window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
       if (_hash.indexOf("@") > -1) {
         return _hash.split("@")[1];
       }

+ 1 - 1
apps/spark/src/spark/templates/editor.mako

@@ -24,7 +24,7 @@ ${ commonheader(_('Query'), app_name, user, "68px") | n,unicode }
 <script type="text/javascript">
   if (window.location.hash != "") {
     if (window.location.hash.indexOf("notebook") > -1) {
-      location.href = "/spark/editor?" + window.location.hash.substr(1);
+      location.href = "/spark/editor?" + window.location.hash.substr(1).replace(/(<([^>]+)>)/ig, "");
     }
   }
 </script>

+ 2 - 2
desktop/libs/indexer/src/indexer/templates/collections.mako

@@ -548,7 +548,7 @@ routie({
     vm.page('manage-page');
   },
   "manage": function() {
-    vm.breadcrumb(window.location.hash.substring(1));
+    vm.breadcrumb(window.location.hash.substring(1).replace(/(<([^>]+)>)/ig, ""));
     vm.page('manage-page');
   },
   "create": function() {
@@ -560,7 +560,7 @@ routie({
     vm.breadcrumb("create/wizard/" + vm.create.wizard.currentPage().url());
   },
   "create/wizard/:step": function(step) {
-    vm.breadcrumb(window.location.hash.substring(1));
+    vm.breadcrumb(window.location.hash.substring(1).replace(/(<([^>]+)>)/ig, ""));
     vm.page('create-page');
     vm.create.wizard.setPageByUrl(step);
     routie('create/wizard/' + vm.create.wizard.currentPage().url());