Browse Source

HUE-4814 [oozie] XML escape variable names in editor submissions

Prakash Ranade 9 years ago
parent
commit
de230fbb36

+ 15 - 1
desktop/libs/liboozie/src/liboozie/tests.py

@@ -75,7 +75,21 @@ def test_config_gen():
 </property>
 </configuration>"""), reformat_xml(config_gen(properties)))
 
-
+def test_config_gen_negative():
+  properties = {
+    'user.name': 'hue<foo>bar</foo>',
+    'test.1': 'http://localhost/test?test1=test&test2=test]]>&test3=test'
+  }
+  assert_equal(reformat_xml("""<configuration>
+<property>
+  <name>test.1</name>
+  <value><![CDATA[http://localhost/test?test1=test&test2=test&test3=test]]></value>
+</property>
+<property>
+  <name>user.name</name>
+  <value><![CDATA[hue<foo>bar</foo>]]></value>
+</property>
+</configuration>"""), reformat_xml(config_gen(properties)))
 
 def test_ssl_validate():
   for desktop_kwargs, conf_kwargs, expected in [

+ 3 - 2
desktop/libs/liboozie/src/liboozie/utils.py

@@ -28,7 +28,7 @@ import logging
 import re
 import time
 from time import strftime
-from django.utils.html import escape
+from xml.sax.saxutils import escape
 
 LOG = logging.getLogger(__name__)
 _NAME_REGEX = re.compile('^[a-zA-Z][\-_a-zA-Z0-0]*$')
@@ -61,9 +61,10 @@ def config_gen(dic):
   sio = StringIO()
   print >> sio, '<?xml version="1.0" encoding="UTF-8"?>'
   print >> sio, "<configuration>"
+  # if dic's key contains <,>,& then it will be escaped and if dic's value contains ']]>' then ']]>' will be stripped
   for k, v in dic.iteritems():
     print >> sio, "<property>\n  <name>%s</name>\n  <value><![CDATA[%s]]></value>\n</property>\n" \
-        % (k, escape(v))
+        % (escape(k), v.replace(']]>', '') if isinstance(v, basestring) else v)
   print >>sio, "</configuration>"
   sio.flush()
   sio.seek(0)