CVE-2021-26544: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-02-20T09:15Z
Repository: https://github.com/apache/incubator-livy
Language: JavaScript
Files changed: server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
Commit date: 2020-08-14 17:25:54 -0700
Commit message: Add html escape to session name

## What changes were proposed in this pull request?

The PR adds HTML escaping to session names.

## How was this patch tested?

Manual test.

Author: Marco Gaido <mgaido@apache.org>

Closes #302 from mgaido91/escape_html.

Diff: diff --git a/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js b/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
index 6e35702..d8a84a7 100644
--- a/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
+++ b/server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
@@ -13,17 +13,21 @@
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 
+function escapeHtml(unescapedText) {
+  return $("<div>").text(unescapedText).html()
+}
+
 function loadSessionsTable(sessions) {
   $.each(sessions, function(index, session) {
     $("#interactive-sessions .sessions-table-body").append(
       "<tr>" +
         tdWrap(uiLink("session/" + session.id, session.id)) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.kind) +
         tdWrap(session.state) +
         tdWrap(logLinks(session, "session")) +
@@ -36,11 +40,11 @@ function loadBatchesTable(sessions) {
   $.each(sessions, function(index, session) {
     $("#batches .sessions-table-body").append(
       "<tr>" +
         tdWrap(session.id) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.state) +
         tdWrap(logLinks(session, "batch")) +
         "</tr>"
@@ -77,6 +81,6 @@ $(document).ready(function () {
   $.when(sessionsReq, batchesReq).done(function () {
     if (numSessions + numBatches == 0) {
       $("#all-sessions").append('<h4>No Sessions or Batches have been created yet.</h4>');
     }
   });
-});
\ No newline at end of file
+});

Vulnerable code:         tdWrap(session.name) +
        tdWrap(session.name) +
});
Fixed code: function escapeHtml(unescapedText) {
  return $("<div>").text(unescapedText).html()
}

        tdWrap(escapeHtml(session.name)) +
        tdWrap(escapeHtml(session.name)) +
});