rashidkpc/Kibana — pull request #154 by scashin133 (2012-11-14 02:35:43+00:00)
Title: Use jquery text calls to sanitize unsafe inputs to prevent XSS attacks

In the stream view there are currently several XSS vulnerabilities that could be taken advantage of. This fixes all the ones I could find. To test:

Do a search in the normal page for
Go to stream view
You'll get a browser alert window

Get a message into logstash that contains in the message
Go to stream view
You'll get a browser alert window

This is fixed by using the jquery dom builder rather than straight str concatenation. Unsafe inputs are added to the DOM using .text calls, rather than .html to ensure they are sanitized.