Stamatis Zampetakis created HIVE-29867:
------------------------------------------
Summary: Test JIRA please ignore
Key: HIVE-29867
URL: https://issues.apache.org/jira/browse/HIVE-29867
Project: Hive
Issue Type: Bug
Reporter: Stamatis Zampetakis
The default widget.display.theme.allowlist (WidgetConf.java:22) includes
widget\.color\..*, widget\.size\..*, widget\.font\..* covering
widget.color.primary, widget.size.max, widget.font.family. WidgetRenderer
(core/render/WidgetRenderer.java:1) applies widget.color.primary via
setDisplayTheme. Display settings affect rendering: background-color,
font-size, and border-width. \\ \\ *ID:* z001 \\ \\ *Affected code:*
core/src/java/com/example/widgets/config/WidgetConf.java:22 \\ \\ *Confidence:*
0.75 \\ \\ *Exploit Scenario:* Run SET widget.color.primary=blue; SET
widget.size.max=1024; then render a dashboard. The widget displays a large blue
box instead of the expected default grey, causing layout overflow on shared
dashboards. \\ \\ *Preconditions:* \\ * Precond1 (dashboard view suffices) \\ *
Precond2 default (admin did not customize) \\ \\ *Recommendation:* Restrict the
allowlist to safe display keys only. Remove widget\.color\..*,
widget\.size\..*, widget\.font\..* broad patterns and replace with specific
entries (widget.color.primary, widget.size.default), excluding unbounded keys.
\\ \\ *Sources:* \\ * widget-analyzer
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
