[
https://issues.apache.org/jira/browse/HIVE-29867?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Stamatis Zampetakis updated HIVE-29867:
---------------------------------------
Description:
The default widget.display.theme.allowlist (WidgetConf.java:22) includes
widget\.color\..*, widget\.size\..*, widget\.font\..* covering
widget.color.primary, widget.size.max, widget.font.family. WidgetRenderer
(core/render/WidgetRenderer.java:1) applies widget.color.primary via
setDisplayTheme. Display settings affect rendering: background-color,
font-size, and border-width. \\ \\ *ID:* z001 \\ *Affected code:*
core/src/java/com/example/widgets/config/WidgetConf.java:22 \\ \\ *Confidence:*
0.75 \\ \\ *Exploit Scenario:* Run SET widget.color.primary=blue; SET
widget.size.max=1024; then render a dashboard. The widget displays a large blue
box instead of the expected default grey, causing layout overflow on shared
dashboards. \\ \\ *Preconditions:* \\* Precond1 (dashboard view suffices) \\*
Precond2 default (admin did not customize) \\ \\ *Recommendation:* Restrict the
allowlist to safe display keys only. Remove widget\.color\..*,
widget\.size\..*, widget\.font\..* broad patterns and replace with specific
entries (widget.color.primary, widget.size.default), excluding unbounded keys.
\\ \\ *Sources:* \\ * widget-analyzer
was:The default widget.display.theme.allowlist (WidgetConf.java:22) includes
widget\.color\..*, widget\.size\..*, widget\.font\..* covering
widget.color.primary, widget.size.max, widget.font.family. WidgetRenderer
(core/render/WidgetRenderer.java:1) applies widget.color.primary via
setDisplayTheme. Display settings affect rendering: background-color,
font-size, and border-width. \\ \\ *ID:* z001 \\ \\ *Affected code:*
core/src/java/com/example/widgets/config/WidgetConf.java:22 \\ \\ *Confidence:*
0.75 \\ \\ *Exploit Scenario:* Run SET widget.color.primary=blue; SET
widget.size.max=1024; then render a dashboard. The widget displays a large blue
box instead of the expected default grey, causing layout overflow on shared
dashboards. \\ \\ *Preconditions:* \\ * Precond1 (dashboard view suffices) \\ *
Precond2 default (admin did not customize) \\ \\ *Recommendation:* Restrict the
allowlist to safe display keys only. Remove widget\.color\..*,
widget\.size\..*, widget\.font\..* broad patterns and replace with specific
entries (widget.color.primary, widget.size.default), excluding unbounded keys.
\\ \\ *Sources:* \\ * widget-analyzer
> Test JIRA please ignore
> -----------------------
>
> Key: HIVE-29867
> URL: https://issues.apache.org/jira/browse/HIVE-29867
> Project: Hive
> Issue Type: Bug
> Reporter: Stamatis Zampetakis
> Priority: Major
> Labels: some-category, widgets/20260811T043204Z
>
> The default widget.display.theme.allowlist (WidgetConf.java:22) includes
> widget\.color\..*, widget\.size\..*, widget\.font\..* covering
> widget.color.primary, widget.size.max, widget.font.family. WidgetRenderer
> (core/render/WidgetRenderer.java:1) applies widget.color.primary via
> setDisplayTheme. Display settings affect rendering: background-color,
> font-size, and border-width. \\ \\ *ID:* z001 \\ *Affected code:*
> core/src/java/com/example/widgets/config/WidgetConf.java:22 \\ \\
> *Confidence:* 0.75 \\ \\ *Exploit Scenario:* Run SET
> widget.color.primary=blue; SET widget.size.max=1024; then render a dashboard.
> The widget displays a large blue box instead of the expected default grey,
> causing layout overflow on shared dashboards. \\ \\ *Preconditions:* \\*
> Precond1 (dashboard view suffices) \\* Precond2 default (admin did not
> customize) \\ \\ *Recommendation:* Restrict the allowlist to safe display
> keys only. Remove widget\.color\..*, widget\.size\..*, widget\.font\..* broad
> patterns and replace with specific entries (widget.color.primary,
> widget.size.default), excluding unbounded keys. \\ \\ *Sources:* \\ *
> widget-analyzer
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
