[GitHub] [hadoop] K0K0V0K opened a new pull request, #5052: YARN-11356. Upgrade DataTables to 1.11.5 to fix CVEs

[GitBox]

K0K0V0K opened a new pull request, #5052:
URL: https://github.com/apache/hadoop/pull/5052

   ### Description of PR
   
   This PR is intended to fix the following CVEs in the DataTables.net lib, by 
upgrading the lib to 1.11.5 
   
   CVE-2020-28458 (HIGH severity) - All versions of package datatables.net are 
vulnerable to Prototype Pollution due to an incomplete fix for 
https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
   
   https://nvd.nist.gov/vuln/detail/CVE-2020-28458
   
   CVE-2021-23445 (MEDIUM severity) - This affects the package datatables.net 
before 1.11.3. If an array is passed to the HTML escape entities function it 
would not have its contents escaped.
   
   https://nvd.nist.gov/vuln/detail/CVE-2021-23445
   
   ### How was this patch tested?
   
   On a local cluster I investigated the UI
   
   - macOS 12.2.1 (21D62)
   - Chrome Version 106.0.5249.119 (Official Build) (arm64)
   
   The new js code is loaded to the browser
   <img width="1709" alt="image" 
src="https://user-images.githubusercontent.com/109747532/196940864-5ccd0183-4e64-4654-9b50-20ba2ea1ac4d.png";>
   
   The sort feature is working:
   <img width="1007" alt="image" 
src="https://user-images.githubusercontent.com/109747532/196941043-70f359bc-ad11-41f3-9fa3-57d535ccd0b1.png";>
   
   The search feature is working:
   <img width="1561" alt="image" 
src="https://user-images.githubusercontent.com/109747532/196941171-032de115-563b-41de-9733-19d63f8e1d8c.png";>
   
   Empty tables are presented:
   <img width="1392" alt="image" 
src="https://user-images.githubusercontent.com/109747532/196941326-c007462b-e7ef-4823-a9d2-21d31924cead.png";>
   
   ### For code changes:
   
   - I had to update the bower.json and ember-cli build with the new versions
   - The UI is using a fix DataTable js code what is present in this repo so i 
updated that too.
   - I updated the Licence file also. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org