Uploaded image for project: 'Hue (READ ONLY)'
  1. Hue (READ ONLY)
  2. HUE-5349

[search] Query definitions can include js XSS injection

          Details

          • Type: Bug
          • Status: Closed
          • Priority: Major
          • Resolution: Incomplete
          • Affects Version/s: 3.11.0
          • Fix Version/s: 4.9.0
          • Component/s: app.dashboard
          • Labels:
            None
          • Environment:

            can’t input the Special characters or backstage move the <script></script> like other function

            Description

            1 choose a solr collection like hue1
            2 click search , open a dashboard link on hue1
            3 click Query definitions ,input XSS injection in the input box,and click "+"

            4 save the dashboard,quit
            5 choose the dashboard once again on the dashboard list
            6 XSS injection happened

              Attachments

                Activity

                  People

                  • Assignee:
                    romain Romain Rigaux
                    Reporter:
                    bigfish yujin
                  • Votes:
                    0 Vote for this issue
                    Watchers:
                    3 Start watching this issue

                    Dates

                    • Created:
                      Updated:
                      Resolved: