dongjoon-hyun commented on code in PR #57165:
URL: https://github.com/apache/spark/pull/57165#discussion_r3555519403
##########
core/src/main/scala/org/apache/spark/ui/UIUtils.scala:
##########
@@ -751,6 +752,32 @@ private[spark] object UIUtils extends Logging {
def getTimeZoneOffset() : Int =
TimeZone.getDefault().getOffset(System.currentTimeMillis()) / 1000 / 60
+ /**
+ * URL-encode a single request-supplied value before embedding it in a log
page query string.
+ * This keeps characters such as '&', '=', '#' and whitespace from changing
the structure of the
+ * subsequent `/log` requests (parameter injection / query truncation).
+ */
+ def encodeLogParam(value: String): String =
URLEncoder.encode(String.valueOf(value), UTF_8)
Review Comment:
`String.valueOf` here is actually a null guard (`getParameter` can return
null and
`URLEncoder.encode(null, ...)` throws NPE), but that intent is easy to miss
and a future
cleanup could drop it as a redundant call. Shall we make it explit?
```suggestion
def encodeLogParam(value: String): String =
URLEncoder.encode(Option(value).getOrElse("null"), UTF_8)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
