----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/55691/#review162593 -----------------------------------------------------------
Fix it, then Ship it! Ship It! src/webui/master/static/js/controllers.js (lines 19 - 21) <https://reviews.apache.org/r/55691/#comment233952> ``` // The random id would be clean up once the pailer window loads the // URL into its sessionStorage, so the possibility of collisions is // acceptable here. ``` src/webui/master/static/js/controllers.js (lines 24 - 25) <https://reviews.apache.org/r/55691/#comment233953> ``` // Store the target URL in localStorage which would be used by the // pailer window later. ``` src/webui/master/static/pailer.html (lines 46 - 67) <https://reviews.apache.org/r/55691/#comment233950> ``` // Set target URL in sessionStorage and clean it in localStorage. (function() { // Avoid fetching target URL again if the navigation comes from // reloading. if (sessionStorage.getItem('isReloaded') !== 'true') { var storageKey = window.name; sessionStorage.setItem(storageKey, localStorage.getItem(storageKey)); localStorage.removeItem(storageKey); sessionStorage.setItem('isReloaded', 'true'); } })(); ``` - haosdent huang On Jan. 18, 2017, 11:40 p.m., Jacob Janco wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/55691/ > ----------------------------------------------------------- > > (Updated Jan. 18, 2017, 11:40 p.m.) > > > Review request for mesos, haosdent huang and Jiang Yan Xu. > > > Bugs: MESOS-6947 > https://issues.apache.org/jira/browse/MESOS-6947 > > > Repository: mesos > > > Description > ------- > > Fix XSS vulnerability in pailer invocation. > > > Diffs > ----- > > src/webui/master/static/js/controllers.js > 388ca2447716cbc7141da6a20daf2340621a16e8 > src/webui/master/static/pailer.html > 19e0981143bd7e8372b49f4f036867e9dd05727a > > Diff: https://reviews.apache.org/r/55691/diff/ > > > Testing > ------- > > make -j8 + test framework + checking pailer representation of files in sandbox > > > Thanks, > > Jacob Janco > >
