Add html escape to session name

## What changes were proposed in this pull request? The PR adds HTML escaping to session names. ## How was this patch tested? Manual test. Author: Marco Gaido <[email protected]> Closes apache#302 from mgaido91/escape_html.
wyfunique · Aug 15, 2020 · 4d8a912 · 4d8a912
1 parent 97cf2f7
commit 4d8a912
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js b/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
@@ -15,13 +15,17 @@
  * limitations under the License.
  */
 
+function escapeHtml(unescapedText) {
+  return $("<div>").text(unescapedText).html()
+}
+
 function loadSessionsTable(sessions) {
   $.each(sessions, function(index, session) {
     $("#interactive-sessions .sessions-table-body").append(
       "<tr>" +
         tdWrap(uiLink("session/" + session.id, session.id)) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.kind) +
@@ -38,7 +42,7 @@ function loadBatchesTable(sessions) {
       "<tr>" +
         tdWrap(session.id) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.state) +
@@ -79,4 +83,4 @@ $(document).ready(function () {
       $("#all-sessions").append('<h4>No Sessions or Batches have been created yet.</h4>');
     }
   });
-});
+});