[
https://issues.apache.org/jira/browse/KNOX-3409?focusedWorklogId=1034544&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1034544
]
ASF GitHub Bot logged work on KNOX-3409:
----------------------------------------
Author: ASF GitHub Bot
Created on: 08/Aug/26 00:50
Start Date: 08/Aug/26 00:50
Worklog Time Spent: 10m
Work Description: lmccay opened a new pull request, #1341:
URL: https://github.com/apache/knox/pull/1341
[KNOX-3409](https://issues.apache.org/jira/browse/KNOX-3409) - Validate
knoxauth theme name to Harden Branding Support
## What changes were proposed in this pull request?
The knoxauth login page read the "theme" query parameter and wrote it into a
<link> tag via document.write() with no validation, allowing arbitrary markup
injection on the page that collects user credentials. The value was also
persisted to localStorage and replayed on later visits, so a single malicious
link kept executing on subsequent visits from a clean URL.
Theme names are now validated against ^[a-zA-Z0-9_-]{1,64}$ on every path
(URL parameter, localStorage, and the configured default), which rejects
quotes, angle brackets, dots and path separators. The stylesheet element is
built with DOM APIs instead of string concatenation, so a theme name can never
be parsed as markup. A stored value that fails validation, or that does not
resolve to an installed theme, is discarded rather than replayed.
Because the only URL the loader can produce is
styles/themes/<name>/theme.css, the themes actually installed on the server
remain the effective allowlist and no new configuration is required. The README
and deployment guide are updated to describe the validation, replacing two
security claims that were inaccurate as written.
Reported by Quinn Nguyen. Not present in any released version - the theming
feature (KNOX-3283) has only ever been on master.
## How was this patch tested?
Manually tested.
There is no existing test harness for this area, we will follow up with a
test suite afterward.
Issue Time Tracking
-------------------
Worklog Id: (was: 1034544)
Remaining Estimate: 0h
Time Spent: 10m
> Validate knoxauth theme name to Harden the Branding Support
> ------------------------------------------------------------
>
> Key: KNOX-3409
> URL: https://issues.apache.org/jira/browse/KNOX-3409
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Reporter: Larry McCay
> Assignee: Larry McCay
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The 'theme' query param is too open to user manipulation of the input.
> We need to harden the validation of the input to only accept what has been
> explictly configured and provided as a directory name for the theme.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
