diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java index 670c3ac1b81..2ebcfb910aa 100644 --- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java +++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileOutputServlet.java @@ -19,6 +19,7 @@ package org.apache.hadoop.hbase.http; import java.io.File; import java.io.IOException; +import java.util.regex.Pattern; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; @@ -37,6 +38,8 @@ public class ProfileOutputServlet extends DefaultServlet { private static final long serialVersionUID = 1L; private static final Logger LOG = LoggerFactory.getLogger(ProfileOutputServlet.class); private static final int REFRESH_PERIOD = 2; + // Alphanumeric characters, plus percent (url-encoding), equals, and ampersand + private static final Pattern ALPHA_NUMERIC = Pattern.compile("[a-zA-Z0-9\\%\\=\\&]*"); @Override protected void doGet(final HttpServletRequest req, final HttpServletResponse resp) @@ -48,11 +51,26 @@ public class ProfileOutputServlet extends DefaultServlet { // will be <100 bytes (in all modes). if (requestedFile.length() < 100) { LOG.info(requestedFile + " is incomplete. Sending auto-refresh header."); - resp.setHeader("Refresh", REFRESH_PERIOD + "," + req.getRequestURI()); + String refreshUrl = req.getRequestURI(); + // Rebuild the query string (if we have one) + if (req.getQueryString() != null) { + refreshUrl += "?" + sanitize(req.getQueryString()); + } + ProfileServlet.setResponseHeader(resp); + resp.setHeader("Refresh", REFRESH_PERIOD + ";" + refreshUrl); resp.getWriter().write("This page will be auto-refreshed every " + REFRESH_PERIOD + - " seconds until the output file is ready."); + " seconds until the output file is ready. Redirecting to " + refreshUrl); } else { super.doGet(req, resp); } } + + static String sanitize(String input) { + // Basic test to try to avoid any XSS attacks or HTML content showing up. + // Duplicates HtmlQuoting a little, but avoid destroying ampersand. + if (ALPHA_NUMERIC.matcher(input).matches()) { + return input; + } + throw new RuntimeException("Non-alphanumeric data found in input, aborting."); + } } diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java index 5dfaa328797..642d05a314a 100644 --- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java +++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/ProfileServlet.java @@ -361,7 +361,7 @@ public class ProfileServlet extends HttpServlet { return Output.SVG; } - private static void setResponseHeader(final HttpServletResponse response) { + static void setResponseHeader(final HttpServletResponse response) { response.setHeader(ACCESS_CONTROL_ALLOW_METHODS, ALLOWED_METHODS); response.setHeader(ACCESS_CONTROL_ALLOW_ORIGIN, "*"); response.setContentType(CONTENT_TYPE_TEXT); diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java new file mode 100644 index 00000000000..77d6c456b50 --- /dev/null +++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestProfileOutputServlet.java @@ -0,0 +1,55 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.hadoop.hbase.http; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.fail; + +import java.util.Arrays; +import java.util.List; + +import org.apache.hadoop.hbase.HBaseClassTestRule; +import org.apache.hadoop.hbase.testclassification.SmallTests; +import org.junit.ClassRule; +import org.junit.Test; +import org.junit.experimental.categories.Category; + +@Category({SmallTests.class}) +public class TestProfileOutputServlet { + @ClassRule + public static final HBaseClassTestRule CLASS_RULE = + HBaseClassTestRule.forClass(TestProfileOutputServlet.class); + + @Test + public void testSanitization() { + List good = Arrays.asList("abcd", "key=value", "key1=value&key2=value2", ""); + for (String input : good) { + assertEquals(input, ProfileOutputServlet.sanitize(input)); + } + List bad = Arrays.asList("function(){console.log(\"oops\")}", "uhoh"); + for (String input : bad) { + try { + ProfileOutputServlet.sanitize(input); + fail("Expected sanitization of \"" + input + "\" to fail"); + } catch (RuntimeException e) { + // Pass + } + } + } + +} diff --git a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon index c4dff1458f2..f700d399473 100644 --- a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon +++ b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/common/TaskMonitorTmpl.jamon @@ -25,6 +25,7 @@ org.apache.hadoop.util.StringUtils; TaskMonitor taskMonitor = TaskMonitor.get(); String filter = "general"; String format = "html"; +String parent = ""; <%if format.equals("json")%> @@ -79,7 +80,7 @@ String format = "html"; <%args> String filter; - View as JSON + View as JSON <%def renderTasks> diff --git a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon index 1062856d9d5..5c5f7fe7cf0 100644 --- a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon +++ b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/master/MasterStatusTmpl.jamon @@ -146,7 +146,7 @@ AssignmentManager assignmentManager = master.getAssignmentManager();
    -
  • Home
    • +
  • Home
  • Table Details
    • <%if master.isActiveMaster() %>
  • Procedures & Locks
    • @@ -279,7 +279,7 @@ AssignmentManager assignmentManager = master.getAssignmentManager();
    - <& ../common/TaskMonitorTmpl; filter = filter &> + <& ../common/TaskMonitorTmpl; filter = filter; parent = "/master-status" &>
    diff --git a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/regionserver/RSStatusTmpl.jamon b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/regionserver/RSStatusTmpl.jamon index 2496b5d1622..bee5da37ba9 100644 --- a/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/regionserver/RSStatusTmpl.jamon +++ b/hbase-server/src/main/jamon/org/apache/hadoop/hbase/tmpl/regionserver/RSStatusTmpl.jamon @@ -107,7 +107,7 @@ org.apache.hadoop.hbase.zookeeper.MasterAddressTracker;
    -
  • Home
    • +
  • Home
  • Process Metrics
  • Local Logs
  • Log Level
    • @@ -143,7 +143,7 @@ org.apache.hadoop.hbase.zookeeper.MasterAddressTracker;
    - <& ../common/TaskMonitorTmpl; filter = filter &> + <& ../common/TaskMonitorTmpl; filter = filter; parent = "/rs-status" &>
    diff --git a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp index ced5b4463de..50ff969b91c 100644 --- a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp +++ b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp @@ -230,7 +230,7 @@ if ( fqtn != null ) { %> <%= escapeXml(meta.getRegionNameAsString()) %> - <%= StringEscapeUtils.escapeHtml4(hostAndPort) %> + <%= StringEscapeUtils.escapeHtml4(hostAndPort) %> <%= readReq%> <%= writeReq%> <%= fileSize%>