HUE-5340 [search] Escape Solr field that have XSS injection (like <sc…

…ript>alert(1234)</script>)
cloudera · Dec 2, 2016 · a3c5943 · a3c5943
1 parent f28a06d
commit a3c5943
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 7 deletions.
diff --git a/apps/search/src/search/models.py b/apps/search/src/search/models.py
@@ -560,7 +560,7 @@ def get_default(self, user, name):
           <div class="span12">%s</div>
         </div>
         <br/>
-      </div>""" % ' '.join(['{{%s}}' % field['name'] for field in fields]),
+      </div>""" % ' '.join(['{{%s}}' % escape(field['name']) for field in fields]),
       "isGridLayout": True,
       "showFieldList": True,
       "showGrid": True,
@@ -599,7 +599,7 @@ def get_default(self, user, name):
   @classmethod
   def _make_field(cls, field, attributes):
     return {
-        'name': str(field),
+        'name': str(escape(field)),
         'type': str(attributes.get('type', '')),
         'isId': attributes.get('required') and attributes.get('uniqueKey'),
         'isDynamic': 'dynamicBase' in attributes

diff --git a/apps/search/src/search/tests.py b/apps/search/src/search/tests.py