Skip to content

Commit 38f37c5

Browse files
n-marionsrowen
n-marion
authored and
srowen
committed
[SPARK-20393][WEBU UI] Strengthen Spark to prevent XSS vulnerabilities
Add stripXSS and stripXSSMap to Spark Core's UIUtils. Calling these functions at any point that getParameter is called against a HttpServletRequest. Unit tests, IBM Security AppScan Standard no longer showing vulnerabilities, manual verification of WebUI pages. Author: NICHOLAS T. MARION <nmarion@us.ibm.com> Closes #17686 from n-marion/xss-fix. (cherry picked from commit b512233) Signed-off-by: Sean Owen <sowen@cloudera.com>
1 parent ebd72f4 commit 38f37c5

File tree

19 files changed

+140
-54
lines changed

19 files changed

+140
-54
lines changed

‎core/src/main/scala/org/apache/spark/deploy/history/HistoryPage.scala‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,9 @@ import org.apache.spark.ui.{UIUtils, WebUIPage}
2626
private[history] class HistoryPage(parent: HistoryServer) extends WebUIPage("") {
2727

2828
def render(request: HttpServletRequest): Seq[Node] = {
29+
// stripXSS is called first to remove suspicious characters used in XSS attacks
2930
val requestedIncomplete =
30-
Option(request.getParameter("showIncomplete")).getOrElse("false").toBoolean
31+
Option(UIUtils.stripXSS(request.getParameter("showIncomplete"))).getOrElse("false").toBoolean
3132

3233
val allAppsSize = parent.getApplicationList().count(_.completed != requestedIncomplete)
3334
val eventLogsUnderProcessCount = parent.getEventLogsUnderProcess()

‎core/src/main/scala/org/apache/spark/deploy/master/ui/ApplicationPage.scala‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ private[ui] class ApplicationPage(parent: MasterWebUI) extends WebUIPage("app")
3333

3434
/** Executor details for a particular application */
3535
def render(request: HttpServletRequest): Seq[Node] = {
36-
val appId = request.getParameter("appId")
36+
// stripXSS is called first to remove suspicious characters used in XSS attacks
37+
val appId = UIUtils.stripXSS(request.getParameter("appId"))
3738
val state = master.askWithRetry[MasterStateResponse](RequestMasterState)
3839
val app = state.activeApps.find(_.id == appId)
3940
.getOrElse(state.completedApps.find(_.id == appId).orNull)

‎core/src/main/scala/org/apache/spark/deploy/master/ui/MasterPage.scala‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,10 @@ private[ui] class MasterPage(parent: MasterWebUI) extends WebUIPage("") {
5757
private def handleKillRequest(request: HttpServletRequest, action: String => Unit): Unit = {
5858
if (parent.killEnabled &&
5959
parent.master.securityMgr.checkModifyPermissions(request.getRemoteUser)) {
60-
val killFlag = Option(request.getParameter("terminate")).getOrElse("false").toBoolean
61-
val id = Option(request.getParameter("id"))
60+
// stripXSS is called first to remove suspicious characters used in XSS attacks
61+
val killFlag =
62+
Option(UIUtils.stripXSS(request.getParameter("terminate"))).getOrElse("false").toBoolean
63+
val id = Option(UIUtils.stripXSS(request.getParameter("id")))
6264
if (id.isDefined && killFlag) {
6365
action(id.get)
6466
}

‎core/src/main/scala/org/apache/spark/deploy/worker/ui/LogPage.scala‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,16 @@ private[ui] class LogPage(parent: WorkerWebUI) extends WebUIPage("logPage") with
3535
private val supportedLogTypes = Set("stderr", "stdout")
3636
private val defaultBytes = 100 * 1024
3737

38+
// stripXSS is called first to remove suspicious characters used in XSS attacks
3839
def renderLog(request: HttpServletRequest): String = {
39-
val appId = Option(request.getParameter("appId"))
40-
val executorId = Option(request.getParameter("executorId"))
41-
val driverId = Option(request.getParameter("driverId"))
42-
val logType = request.getParameter("logType")
43-
val offset = Option(request.getParameter("offset")).map(_.toLong)
44-
val byteLength = Option(request.getParameter("byteLength")).map(_.toInt).getOrElse(defaultBytes)
40+
val appId = Option(UIUtils.stripXSS(request.getParameter("appId")))
41+
val executorId = Option(UIUtils.stripXSS(request.getParameter("executorId")))
42+
val driverId = Option(UIUtils.stripXSS(request.getParameter("driverId")))
43+
val logType = UIUtils.stripXSS(request.getParameter("logType"))
44+
val offset = Option(UIUtils.stripXSS(request.getParameter("offset"))).map(_.toLong)
45+
val byteLength =
46+
Option(UIUtils.stripXSS(request.getParameter("byteLength"))).map(_.toInt)
47+
.getOrElse(defaultBytes)
4548

4649
val logDir = (appId, executorId, driverId) match {
4750
case (Some(a), Some(e), None) =>
@@ -57,13 +60,16 @@ private[ui] class LogPage(parent: WorkerWebUI) extends WebUIPage("logPage") with
5760
pre + logText
5861
}
5962

63+
// stripXSS is called first to remove suspicious characters used in XSS attacks
6064
def render(request: HttpServletRequest): Seq[Node] = {
61-
val appId = Option(request.getParameter("appId"))
62-
val executorId = Option(request.getParameter("executorId"))
63-
val driverId = Option(request.getParameter("driverId"))
64-
val logType = request.getParameter("logType")
65-
val offset = Option(request.getParameter("offset")).map(_.toLong)
66-
val byteLength = Option(request.getParameter("byteLength")).map(_.toInt).getOrElse(defaultBytes)
65+
val appId = Option(UIUtils.stripXSS(request.getParameter("appId")))
66+
val executorId = Option(UIUtils.stripXSS(request.getParameter("executorId")))
67+
val driverId = Option(UIUtils.stripXSS(request.getParameter("driverId")))
68+
val logType = UIUtils.stripXSS(request.getParameter("logType"))
69+
val offset = Option(UIUtils.stripXSS(request.getParameter("offset"))).map(_.toLong)
70+
val byteLength =
71+
Option(UIUtils.stripXSS(request.getParameter("byteLength"))).map(_.toInt)
72+
.getOrElse(defaultBytes)
6773

6874
val (logDir, params, pageName) = (appId, executorId, driverId) match {
6975
case (Some(a), Some(e), None) =>

‎core/src/main/scala/org/apache/spark/ui/UIUtils.scala‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ import scala.util.control.NonFatal
2525
import scala.xml._
2626
import scala.xml.transform.{RewriteRule, RuleTransformer}
2727

28+
import org.apache.commons.lang3.StringEscapeUtils
29+
2830
import org.apache.spark.internal.Logging
2931
import org.apache.spark.ui.scope.RDDOperationGraph
3032

@@ -34,6 +36,8 @@ private[spark] object UIUtils extends Logging {
3436
val TABLE_CLASS_STRIPED = TABLE_CLASS_NOT_STRIPED + " table-striped"
3537
val TABLE_CLASS_STRIPED_SORTABLE = TABLE_CLASS_STRIPED + " sortable"
3638

39+
private val NEWLINE_AND_SINGLE_QUOTE_REGEX = raw"(?i)(\r\n|\n|\r|%0D%0A|%0A|%0D|'|%27)".r
40+
3741
// SimpleDateFormat is not thread-safe. Don't expose it to avoid improper use.
3842
private val dateFormat = new ThreadLocal[SimpleDateFormat]() {
3943
override def initialValue(): SimpleDateFormat =
@@ -524,4 +528,21 @@ private[spark] object UIUtils extends Logging {
524528
origHref
525529
}
526530
}
531+
532+
/**
533+
* Remove suspicious characters of user input to prevent Cross-Site scripting (XSS) attacks
534+
*
535+
* For more information about XSS testing:
536+
* https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet and
537+
* https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OTG-INPVAL-001)
538+
*/
539+
def stripXSS(requestParameter: String): String = {
540+
if (requestParameter == null) {
541+
null
542+
} else {
543+
// Remove new lines and single quotes, followed by escaping HTML version 4.0
544+
StringEscapeUtils.escapeHtml4(
545+
NEWLINE_AND_SINGLE_QUOTE_REGEX.replaceAllIn(requestParameter, ""))
546+
}
547+
}
527548
}

‎core/src/main/scala/org/apache/spark/ui/exec/ExecutorThreadDumpPage.scala‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,10 @@ private[ui] class ExecutorThreadDumpPage(parent: ExecutorsTab) extends WebUIPage
2727

2828
private val sc = parent.sc
2929

30+
// stripXSS is called first to remove suspicious characters used in XSS attacks
3031
def render(request: HttpServletRequest): Seq[Node] = {
31-
val executorId = Option(request.getParameter("executorId")).map { executorId =>
32+
val executorId =
33+
Option(UIUtils.stripXSS(request.getParameter("executorId"))).map { executorId =>
3234
UIUtils.decodeURLParameter(executorId)
3335
}.getOrElse {
3436
throw new IllegalArgumentException(s"Missing executorId parameter")

‎core/src/main/scala/org/apache/spark/ui/jobs/AllJobsPage.scala‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -220,18 +220,20 @@ private[ui] class AllJobsPage(parent: JobsTab) extends WebUIPage("") {
220220
jobTag: String,
221221
jobs: Seq[JobUIData],
222222
killEnabled: Boolean): Seq[Node] = {
223-
val allParameters = request.getParameterMap.asScala.toMap
223+
// stripXSS is called to remove suspicious characters used in XSS attacks
224+
val allParameters = request.getParameterMap.asScala.toMap.mapValues(_.map(UIUtils.stripXSS))
224225
val parameterOtherTable = allParameters.filterNot(_._1.startsWith(jobTag))
225226
.map(para => para._1 + "=" + para._2(0))
226227

227228
val someJobHasJobGroup = jobs.exists(_.jobGroup.isDefined)
228229
val jobIdTitle = if (someJobHasJobGroup) "Job Id (Job Group)" else "Job Id"
229230

230-
val parameterJobPage = request.getParameter(jobTag + ".page")
231-
val parameterJobSortColumn = request.getParameter(jobTag + ".sort")
232-
val parameterJobSortDesc = request.getParameter(jobTag + ".desc")
233-
val parameterJobPageSize = request.getParameter(jobTag + ".pageSize")
234-
val parameterJobPrevPageSize = request.getParameter(jobTag + ".prevPageSize")
231+
// stripXSS is called first to remove suspicious characters used in XSS attacks
232+
val parameterJobPage = UIUtils.stripXSS(request.getParameter(jobTag + ".page"))
233+
val parameterJobSortColumn = UIUtils.stripXSS(request.getParameter(jobTag + ".sort"))
234+
val parameterJobSortDesc = UIUtils.stripXSS(request.getParameter(jobTag + ".desc"))
235+
val parameterJobPageSize = UIUtils.stripXSS(request.getParameter(jobTag + ".pageSize"))
236+
val parameterJobPrevPageSize = UIUtils.stripXSS(request.getParameter(jobTag + ".prevPageSize"))
235237

236238
val jobPage = Option(parameterJobPage).map(_.toInt).getOrElse(1)
237239
val jobSortColumn = Option(parameterJobSortColumn).map { sortColumn =>

‎core/src/main/scala/org/apache/spark/ui/jobs/JobPage.scala‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,8 @@ private[ui] class JobPage(parent: JobsTab) extends WebUIPage("job") {
187187
val listener = parent.jobProgresslistener
188188

189189
listener.synchronized {
190-
val parameterId = request.getParameter("id")
190+
// stripXSS is called first to remove suspicious characters used in XSS attacks
191+
val parameterId = UIUtils.stripXSS(request.getParameter("id"))
191192
require(parameterId != null && parameterId.nonEmpty, "Missing id parameter")
192193

193194
val jobId = parameterId.toInt

‎core/src/main/scala/org/apache/spark/ui/jobs/JobsTab.scala‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ package org.apache.spark.ui.jobs
2020
import javax.servlet.http.HttpServletRequest
2121

2222
import org.apache.spark.scheduler.SchedulingMode
23-
import org.apache.spark.ui.{SparkUI, SparkUITab}
23+
import org.apache.spark.ui.{SparkUI, SparkUITab, UIUtils}
2424

2525
/** Web UI showing progress status of all jobs in the given SparkContext. */
2626
private[ui] class JobsTab(parent: SparkUI) extends SparkUITab(parent, "jobs") {
@@ -40,7 +40,8 @@ private[ui] class JobsTab(parent: SparkUI) extends SparkUITab(parent, "jobs") {
4040

4141
def handleKillRequest(request: HttpServletRequest): Unit = {
4242
if (killEnabled && parent.securityManager.checkModifyPermissions(request.getRemoteUser)) {
43-
val jobId = Option(request.getParameter("id")).map(_.toInt)
43+
// stripXSS is called first to remove suspicious characters used in XSS attacks
44+
val jobId = Option(UIUtils.stripXSS(request.getParameter("id"))).map(_.toInt)
4445
jobId.foreach { id =>
4546
if (jobProgresslistener.activeJobs.contains(id)) {
4647
sc.foreach(_.cancelJob(id))

‎core/src/main/scala/org/apache/spark/ui/jobs/PoolPage.scala‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ private[ui] class PoolPage(parent: StagesTab) extends WebUIPage("pool") {
3131

3232
def render(request: HttpServletRequest): Seq[Node] = {
3333
listener.synchronized {
34-
val poolName = Option(request.getParameter("poolname")).map { poolname =>
34+
// stripXSS is called first to remove suspicious characters used in XSS attacks
35+
val poolName = Option(UIUtils.stripXSS(request.getParameter("poolname"))).map { poolname =>
3536
UIUtils.decodeURLParameter(poolname)
3637
}.getOrElse {
3738
throw new IllegalArgumentException(s"Missing poolname parameter")

0 commit comments

Comments
 (0)