This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch branch-3.5
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/branch-3.5 by this push:
new 2b0fc2ad049f [MINOR][UI] Escape HTML when rendering error messages in
the Web UI tables ### What changes were proposed in this pull request?
2b0fc2ad049f is described below
commit 2b0fc2ad049f237b75bddb190ef598fe2ba7d783
Author: Holden Karau <[email protected]>
AuthorDate: Thu Jul 9 10:55:36 2026 -0700
[MINOR][UI] Escape HTML when rendering error messages in the Web UI tables
### What changes were proposed in this pull request?
Task error messages and stage failure reasons are rendered by the Web UI
JavaScript (the stage-page task table, and app names on the history page) by
concatenating the text directly into HTML. Error text that contains HTML
metacharacters (for example ge>
### Why are the changes needed?
Table formatting can break
### Does this PR introduce _any_ user-facing change?
Not really (fixes a usable visible bug with table formatting)
### How was this patch tested?
New test added.
### Was this patch authored or co-authored using generative AI tooling?
Claude 4.8 primarily
Backport of bced71369c73f3c2e5980c6be2dc2a64bcab74db
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Co-Authored-By: Holden Karau <[email protected]>
Co-Authored-By: Holden Karau <[email protected]>
---
.../resources/org/apache/spark/ui/static/stagepage.js | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/core/src/main/resources/org/apache/spark/ui/static/stagepage.js
b/core/src/main/resources/org/apache/spark/ui/static/stagepage.js
index c7513c8268b2..0c0abca26ae5 100644
--- a/core/src/main/resources/org/apache/spark/ui/static/stagepage.js
+++ b/core/src/main/resources/org/apache/spark/ui/static/stagepage.js
@@ -21,6 +21,18 @@
var shouldBlockUI = true;
+/* Escape a value for safe inclusion in HTML text content. Non-string values
are
+ * coerced to a string first; null/undefined are returned unchanged. */
+function escapeHtml(text) {
+ if (text === null || text === undefined) return text;
+ return String(text)
+ .replace(/&/g, "&")
+ .replace(/</g, "<")
+ .replace(/>/g, ">")
+ .replace(/"/g, """)
+ .replace(/'/g, "'");
+}
+
$(document).ajaxStop(function () {
if (shouldBlockUI) {
$.unblockUI();
@@ -1072,8 +1084,8 @@ $(document).ready(function () {
var indexOfLineSeparator = msg.indexOf("\n");
var formHead = indexOfLineSeparator > 0 ? msg.substring(0,
indexOfLineSeparator) : (msg.length > 100 ? msg.substring(0, 100) : msg);
var form = "<span
onclick=\"this.parentNode.querySelector('.stacktrace-details').classList.toggle('collapsed')\"
class=\"expand-details\">+details</span>";
- var formMsg = "<div class=\"stacktrace-details
collapsed\"><pre>" + row.errorMessage + "</pre></div>";
- return formHead + form + formMsg;
+ var formMsg = "<div class=\"stacktrace-details
collapsed\"><pre>" + escapeHtml(row.errorMessage) + "</pre></div>";
+ return escapeHtml(formHead) + form + formMsg;
}
},
name: "Errors"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
