Details
Major Description
Users can inject inline scripts (e.g. onclick or onmouseover handlers) in the UI job and stage descriptions.
The UI already has precaution to treat, e.g., <script> tags as plain-text. But that doesn't extend to inline scripts.
Example:
Bad job descriptions
scala> sc.setJobDescription("""<a href="/link" onmouseover="alert('oops');">onmouseover</a>""") scala> spark.sql("SELECT 1").show() ... scala> sc.setJobDescription("""<a href="/link" onclick="alert('oops');">onclick</a>""") scala> spark.sql("SELECT 1").show() ...
Attachments
Attachments
Issue Links
- links to