lmccay opened a new pull request, #1341: URL: https://github.com/apache/knox/pull/1341
[KNOX-3409](https://issues.apache.org/jira/browse/KNOX-3409) - Validate knoxauth theme name to Harden Branding Support ## What changes were proposed in this pull request? The knoxauth login page read the "theme" query parameter and wrote it into a <link> tag via document.write() with no validation, allowing arbitrary markup injection on the page that collects user credentials. The value was also persisted to localStorage and replayed on later visits, so a single malicious link kept executing on subsequent visits from a clean URL. Theme names are now validated against ^[a-zA-Z0-9_-]{1,64}$ on every path (URL parameter, localStorage, and the configured default), which rejects quotes, angle brackets, dots and path separators. The stylesheet element is built with DOM APIs instead of string concatenation, so a theme name can never be parsed as markup. A stored value that fails validation, or that does not resolve to an installed theme, is discarded rather than replayed. Because the only URL the loader can produce is styles/themes/<name>/theme.css, the themes actually installed on the server remain the effective allowlist and no new configuration is required. The README and deployment guide are updated to describe the validation, replacing two security claims that were inaccurate as written. Reported by Quinn Nguyen. Not present in any released version - the theming feature (KNOX-3283) has only ever been on master. ## How was this patch tested? Manually tested. There is no existing test harness for this area, we will follow up with a test suite afterward. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
