diff --git a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp index 6ca818f35c8..19e66e1b35c 100644 --- a/hbase-server/src/main/resources/hbase-webapps/master/table.jsp +++ b/hbase-server/src/main/resources/hbase-webapps/master/table.jsp @@ -20,6 +20,7 @@ <%@ page contentType="text/html;charset=UTF-8" import="static org.apache.commons.lang.StringEscapeUtils.escapeXml" import="com.google.protobuf.ByteString" + import="java.net.URLEncoder" import="java.util.ArrayList" import="java.util.TreeMap" import="java.util.List" @@ -28,6 +29,7 @@ import="java.util.Collections" import="java.util.Comparator" import="java.util.Collection" + import="org.apache.commons.lang.StringEscapeUtils" import="org.apache.hadoop.conf.Configuration" import="org.apache.hadoop.util.StringUtils" import="org.apache.hadoop.hbase.client.HTable" @@ -56,6 +58,7 @@ Configuration conf = master.getConfiguration(); MetaTableLocator metaTableLocator = new MetaTableLocator(); String fqtn = request.getParameter("name"); + final String escaped_fqtn = StringEscapeUtils.escapeHtml(fqtn); String sortKey = request.getParameter("sort"); String reverse = request.getParameter("reverse"); final boolean reverseOrder = (reverse==null||!reverse.equals("false")); @@ -105,9 +108,9 @@ <% if ( !readOnly && action != null ) { %> - HBase Master: <%= master.getServerName() %> + HBase Master: <%= StringEscapeUtils.escapeHtml(master.getServerName().toString()) %> <% } else { %> - Table: <%= fqtn %> + Table: <%= escaped_fqtn %> <% } %> @@ -207,7 +210,7 @@ if ( fqtn != null ) {
-

Table <%= fqtn %>

+

Table <%= escaped_fqtn %>

@@ -232,7 +235,8 @@ if ( fqtn != null ) { if (metaLocation != null) { ServerLoad sl = master.getServerManager().getLoad(metaLocation); - url = "//" + metaLocation.getHostname() + ":" + master.getRegionServerInfoPort(metaLocation) + "/"; + // The host name portion should be safe, but I don't know how we handle IDNs so err on the side of failing safely. + url = "//" + URLEncoder.encode(metaLocation.getHostname()) + ":" + master.getRegionServerInfoPort(metaLocation) + "/"; if (sl != null) { Map map = sl.getRegionsLoad(); if (map.containsKey(meta.getRegionName())) { @@ -249,7 +253,7 @@ if ( fqtn != null ) { %> <%= escapeXml(meta.getRegionNameAsString()) %> - <%= metaLocation.getHostname().toString() + ":" + master.getRegionServerInfoPort(metaLocation) %> + <%= StringEscapeUtils.escapeHtml(metaLocation.getHostname().toString()) + ":" + master.getRegionServerInfoPort(metaLocation) %> <%= readReq%> <%= writeReq%> <%= fileSize%> @@ -287,8 +291,10 @@ if ( fqtn != null ) { <%= compactionState %> <% } catch (Exception e) { - // Nothing really to do here - e.printStackTrace(); + // Nothing really to do here + for(StackTraceElement element : e.getStackTrace()) { + %><%= StringEscapeUtils.escapeHtml(element.toString()) %><% + } %> Unknown <% } %> @@ -314,7 +320,7 @@ if ( fqtn != null ) { for (HColumnDescriptor family: families) { %> - <%= family.getNameAsString() %> + <%= StringEscapeUtils.escapeHtml(family.getNameAsString()) %> @@ -328,10 +334,10 @@ if ( fqtn != null ) { %> <% } %> @@ -602,7 +608,7 @@ ShowDetailName&Start/End Key"><%= addr.getHostname().toString() + ":" + master.getRegionServerInfoPort(addr) %> + <%= StringEscapeUtils.escapeHtml(addr.getHostname().toString()) + ":" + master.getRegionServerInfoPort(addr) %> <% } else { @@ -652,7 +658,7 @@ ShowDetailName&Start/End Key

This table has <%= numRegions %> regions in total, in order to improve the page load time, only <%= numRegionsRendered %> regions are displayed here, click @@ -671,12 +677,12 @@ if (withReplica) { } %> <% - for (Map.Entry rdEntry : regDistribution.entrySet()) { - ServerName addr = rdEntry.getKey(); - String url = "//" + addr.getHostname() + ":" + master.getRegionServerInfoPort(addr) + "/rs-status"; + for (Map.Entry rdEntry : regDistribution.entrySet()) { + ServerName addr = rdEntry.getKey(); + String url = "//" + URLEncoder.encode(addr.getHostname()) + ":" + master.getRegionServerInfoPort(addr) + "/"; %>

- + <% if (withReplica) { @@ -690,7 +696,9 @@ if (withReplica) {
- <%= Bytes.toString(familyKey.get(), familyKey.getOffset(), familyKey.getLength()) %> + <%= StringEscapeUtils.escapeHtml(Bytes.toString(familyKey.get(), familyKey.getOffset(), familyKey.getLength())) %> - <%= Bytes.toString(familyValue.get(), familyValue.getOffset(), familyValue.getLength()) %> + <%= StringEscapeUtils.escapeHtml(Bytes.toString(familyValue.get(), familyValue.getOffset(), familyValue.getLength())) %>
<%= addr.getHostname().toString() + ":" + master.getRegionServerInfoPort(addr) %><%= StringEscapeUtils.escapeHtml(addr.getHostname().toString()) + ":" + master.getRegionServerInfoPort(addr) %> <%= rdEntry.getValue()%>
<% } } catch(Exception ex) { - ex.printStackTrace(System.err); + for(StackTraceElement element : ex.getStackTrace()) { + %><%= StringEscapeUtils.escapeHtml(element.toString()) %><% + } } finally { admin.close(); } @@ -720,7 +728,7 @@ Actions:
- +   @@ -734,7 +742,7 @@ Actions: - +   @@ -748,7 +756,7 @@ Actions: - +   @@ -785,7 +793,7 @@ Actions: