Vulnerability: Cross-site scripting (XSS) in Apache Livy Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Vulnerability ID: GHSA-74qp-233x-p5j8
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/apache/incubator-livy
Published: 2021-05-13
File: server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js
Commit message: Add html escape to session name

## What changes were proposed in this pull request?

The PR adds HTML escaping to session names.

## How was this patch tested?

Manual test.

Author: Marco Gaido <mgaido@apache.org>

Closes #302 from mgaido91/escape_html.
Commit author: Marco Gaido

Vulnerable version (before fix):
  * limitations under the License.  */  function loadSessionsTable(sessions) {   $.each(sessions, function(index, session) {     $("#interactive-sessions .sessions-table-body").append(       "<tr>" +         tdWrap(uiLink("session/" + session.id, session.id)) +         tdWrap(appIdLink(session)) +         tdWrap(session.name) +         tdWrap(session.owner) +         tdWrap(session.proxyUser) +         tdWrap(session.kind) + function loadBatchesTable(sessions) {       "<tr>" +         tdWrap(session.id) +         tdWrap(appIdLink(session)) +         tdWrap(session.name) +         tdWrap(session.owner) +         tdWrap(session.proxyUser) +         tdWrap(session.state) + $(document).ready(function () {       $("#all-sessions").append('<h4>No Sessions or Batches have been created yet.</h4>');     }   }); });\ No newline at end of file

Fixed version (after fix):
  * limitations under the License.  */  function escapeHtml(unescapedText) {   return $("<div>").text(unescapedText).html() }  function loadSessionsTable(sessions) {   $.each(sessions, function(index, session) {     $("#interactive-sessions .sessions-table-body").append(       "<tr>" +         tdWrap(uiLink("session/" + session.id, session.id)) +         tdWrap(appIdLink(session)) +         tdWrap(escapeHtml(session.name)) +         tdWrap(session.owner) +         tdWrap(session.proxyUser) +         tdWrap(session.kind) + function loadBatchesTable(sessions) {       "<tr>" +         tdWrap(session.id) +         tdWrap(appIdLink(session)) +         tdWrap(escapeHtml(session.name)) +         tdWrap(session.owner) +         tdWrap(session.proxyUser) +         tdWrap(session.state) + $(document).ready(function () {       $("#all-sessions").append('<h4>No Sessions or Batches have been created yet.</h4>');     }   });\ No newline at end of file });

Patch:
patch: @@ -15,13 +15,17 @@
  * limitations under the License.
  */
 
+function escapeHtml(unescapedText) {
+  return $("<div>").text(unescapedText).html()
+}
+
 function loadSessionsTable(sessions) {
   $.each(sessions, function(index, session) {
     $("#interactive-sessions .sessions-table-body").append(
       "<tr>" +
         tdWrap(uiLink("session/" + session.id, session.id)) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.kind) +
@@ -38,7 +42,7 @@ function loadBatchesTable(sessions) {
       "<tr>" +
         tdWrap(session.id) +
         tdWrap(appIdLink(session)) +
-        tdWrap(session.name) +
+        tdWrap(escapeHtml(session.name)) +
         tdWrap(session.owner) +
         tdWrap(session.proxyUser) +
         tdWrap(session.state) +
@@ -79,4 +83,4 @@ $(document).ready(function () {
       $("#all-sessions").append('<h4>No Sessions or Batches have been created yet.</h4>');
     }
   });
-});
\ No newline at end of file
+});
path: server/src/main/resources/org/apache/livy/server/ui/static/js/all-sessions.js