[
https://issues.apache.org/jira/browse/GEODE-10612?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18108347#comment-18108347
]
ASF subversion and git services commented on GEODE-10612:
---------------------------------------------------------
Commit 2470c4e891b56e74cdf42fb21e86a4588d88f4e3 in geode's branch
refs/heads/develop from Jinwoo Hwang
[ https://gitbox.apache.org/repos/asf?p=geode.git;h=2470c4e891 ]
GEODE-10612: Encode region path in Pulse region-detail error messages (#8041)
When a region-detail request names a path that does not resolve, the
region services return "Region [<path>] is not available" in the
errorOnRegion field, which the Pulse UI displays. Paths containing
characters such as '<' or '&' did not display correctly.
> Pulse region-detail error message does not display the requested region path
> correctly
> --------------------------------------------------------------------------------------
>
> Key: GEODE-10612
> URL: https://issues.apache.org/jira/browse/GEODE-10612
> Project: Geode
> Issue Type: Improvement
> Reporter: Jinwoo Hwang
> Assignee: Jinwoo Hwang
> Priority: Major
>
> When the region-detail page is opened for a path that does not resolve to an
> existing region, Pulse displays:
> Region [<path>] is not available
> The path comes from the page URL and is inserted into that message, and the
> message is rendered into the page as HTML. Characters that are significant in
> HTML - '<', '>', '&', quotes - are therefore consumed by the browser instead
> of
> being shown, so the operator sees an altered or truncated path rather than the
> one that was actually requested. That makes the message misleading in exactly
> the situation where it needs to be precise: telling the operator which path
> could not be found.
> Steps to reproduce
> ------------------
> 1. Start a locator with the HTTP service enabled and log in to Pulse.
> 2. Open a region-detail URL whose path contains an HTML character, e.g.
> /pulse/regionDetail.html?regionFullPath=%2Forders%3C2026%3E
> 3. Observe the "is not available" message.
> Expected: Region [/orders<2026>] is not available
> Actual: the "<2026>" portion is missing from the displayed path
> Notes
> -----
> Region names themselves are restricted to alphanumeric characters, hyphens and
> underscores (RegionNameValidation), so this only affects paths that do not
> correspond to an existing region - which is precisely the case this message
> exists to report. It is reachable through stale or externally generated links,
> such as a bookmarked region-detail URL for a region that has since been
> destroyed, or a link constructed by external tooling.
> Two services build this message and both are affected:
> - ClusterSelectedRegionService
> - ClusterSelectedRegionsMemberService
> Suggested fix
> -------------
> Encode the path for the HTML context when building the message. The region
> lookup should continue to use the path exactly as supplied, so that resolution
> behaviour is unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
