[
https://issues.apache.org/jira/browse/AMBARI-20823?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15981742#comment-15981742
]
Hadoop QA commented on AMBARI-20823:
------------------------------------
{color:green}+1 overall{color}. Here are the results of testing the latest
attachment
http://issues.apache.org/jira/secure/attachment/12864785/AMBARI-20823.patch
against trunk revision .
{color:green}+1 @author{color}. The patch does not contain any @author
tags.
{color:green}+1 tests included{color}. The patch appears to include 1 new
or modified test files.
{color:green}+1 release audit{color}. The applied patch does not increase
the total number of release audit warnings.
{color:green}+1 javac{color}. The applied patch does not increase the
total number of javac compiler warnings.
{color:green}+1 core tests{color}. The patch passed unit tests in
ambari-server.
Console output:
https://builds.apache.org/job/Ambari-trunk-test-patch/11464//console
This message is automatically generated.
> Remove user input from invalid renderer error message
> -----------------------------------------------------
>
> Key: AMBARI-20823
> URL: https://issues.apache.org/jira/browse/AMBARI-20823
> Project: Ambari
> Issue Type: Bug
> Components: ambari-server
> Affects Versions: 1.5.0
> Reporter: Robert Levas
> Assignee: Attila Magyar
> Priority: Critical
> Fix For: 2.5.1
>
> Attachments: AMBARI-20823.patch
>
>
> Remove user input from invalid renderer error message to avoid potential XSS
> attacks.
> The user input data returned in the exception thrown at
> {code:title=org/apache/ambari/server/api/resources/BaseResourceDefinition.java:135}
> throw new IllegalArgumentException("Invalid renderer name: " + name +
> " for resource of type: " + m_type);
> {code}
> should be removed and the error message changed to:
> {noformat}
> Invalid renderer name for resource of type <resource type>.m
> {noformat}
> or simply
> {noformat}
> Invalid renderer name.
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
