nathanmarz/storm — pull request #488 by d2r (2013-02-26 09:47:48+00:00)
Title: Escape HTML and JavaScript in web UI

Fixes several places where malicious or inadvertent topology or component names can lead to XSS or malformed presentation in the UI.

Most of the testing was manual, and the coded tests were brittle.

The test file I used—which includes descriptions of the manual tests—is here in-line.

```
(ns backtype.storm.ui-test
(:use [backtype.storm.ui core])
(:use [clojure test])
(:use [hiccup.core :only (html)])
)

(deftest test-javascript-escaped-in-action-buttons
(let [expected-s "confirmAction('XX\\\"XX\\'XX\\\\XX\\/XX\\nXX', 'XX\\\"XX\\'XX\\\\XX\\/XX\\nXX', 'activate', false, 0)"
malicious-js "XX\"XX'XX\\XX/XX
XX"
result (topology-action-button malicious-js malicious-js
"Activate" "activate" false 0 true)
onclick (:onclick (second result))]

(is (= expected-s onclick)
"Escapes quotes, slashes, back-slashes, and new-lines.")
)
)

(deftest test-topology-link-escapes-content-html
(let [topo-name "BOGUSTOPO"]
(is (= (str "<BLINK>foobar")
(html (topology-link topo-name "foobar"))))
)
)

(deftest test-component-link-escapes-content-html
(let [topo-name "BOGUSTOPO"]
(is (= (str "<BLINK>comp-id")
(html (component-link topo-name "comp-id"))))
)
)

; main-topology-summary-table
; submit topo name like "foobar"
; Load / and visually confirm the 'id' column does not blink for the topo.

; topology-summary-table
; submit topo name like "foobar"
; Load / and visually confirm the 'id' column does not blink for the topo or the name

; topology-summary-table
; submit topo name like "foobar"
; Load / and visually confirm the 'id' column does not blink for the topo or the name

; component-page
; recompile a topology (such as the ExclamationTopology from storm-starter) and hardcode bolt/spout names with ''
; Load the bolt or spout component page and visually confirm the 'id' column does not blink the component name.

; bolt-input-summary-table
; recompile a topology (such as the ExclamationTopology from storm-starter) and hardcode bolt names with ''
; A bolt component page and visually confirm the 'component' column of the Input stats does not blink the component name.
```