cloudera/hue — pull request #128 by petro-rudenko (2014-11-25 16:57:17+00:00)
Title: [oozie] XML External Entity Processing vulnerability

Hue is vulnerable to [XML External Entity Processing attack](http://en.wikipedia.org/wiki/XML_external_entity). Steps to reproduce: oozie -> editor -> workflow -> import and import next xml:
```xml

]>

${jobTracker}
${nameNode}
qbc
${records}
&xxe;

${jobTracker}
${nameNode}
org.apache.hadoop.examples.terasort.TeraSort
${output_dir}/teragen
${output_dir}/terasort

Action failed, error message[${wf:errorMessage(wf:lastErrorNode())}]

```

You'll see the content of /etc/passwd in the first action arguments. Need to use something like [this library](https://pypi.python.org/pypi/defusedxml) to protect. It requires lxml > 3.0 version, so it was upgraded.