big-data/hadoop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HADOOP-6441. Protect web ui from cross site scripting attacks (XSS) on

Browse Source 
the host http header and using encoded utf-7. (omalley)


git-svn-id: https://svn.apache.org/repos/asf/hadoop/common/trunk@891132 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Owen O'Malley 2009-12-16 06:31:51 +00:00
parent e8d9bf47ab
commit 875c9d62c6
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES.txt
View File

@ -1222,6 +1222,9 @@ Release 0.21.0 - Unreleased
HADOOP-6375. Sync documentation for FsShell du with its implementation.
(Todd Lipcon via cdouglas)
HADOOP-6441. Protect web ui from cross site scripting attacks (XSS) on
the host http header and using encoded utf-7. (omalley)
Release 0.20.2 - Unreleased
NEW FEATURES

23
src/java/org/apache/hadoop/http/HttpServer.java
View File

@ -624,6 +624,25 @@ public Map<String, String[]> getParameterMap() {
}
return result;
}
/**
* Quote the url so that users specifying the HOST HTTP header
* can't inject attacks.
*/
@Override
public StringBuffer getRequestURL(){
String url = rawRequest.getRequestURL().toString();
return new StringBuffer(HtmlQuoting.quoteHtmlChars(url));
}
/**
* Quote the server name so that users specifying the HOST HTTP header
* can't inject attacks.
*/
@Override
public String getServerName() {
return HtmlQuoting.quoteHtmlChars(rawRequest.getServerName());
}
}
@Override
@ -641,6 +660,10 @@ public void doFilter(ServletRequest request,
) throws IOException, ServletException {
HttpServletRequestWrapper quoted =
new RequestQuoter((HttpServletRequest) request);
final HttpServletResponse httpResponse = (HttpServletResponse) response;
// set the default to UTF-8 so that we don't need to worry about IE7
// choosing to interpret the special characters as UTF-7
httpResponse.setContentType("text/html;charset=utf-8");
chain.doFilter(quoted, response);
}