dongjoon-hyun opened a new pull request, #57288:
URL: https://github.com/apache/spark/pull/57288

   ### What changes were proposed in this pull request?
   
   This PR HTML-escapes the executor removal reason before embedding it into 
the executor event timeline tooltip, in both `AllJobsPage` and `JobPage`. 
`Utility.escape` is applied twice, matching the adjacent job description and 
stage name handling (`jsEscapedDescForTooltip` / `jsEscapedNameForTooltip`): 
the value is parsed once as the `data-bs-title` attribute value, and once more 
when Bootstrap assigns it as the tooltip `innerHTML`.
   
   It also drops `private` from `AllJobsPage.makeExecutorEvent` so the new test 
can call it. `JobPage.makeExecutorEvent` is already non-private, and both 
classes are `private[ui]`, so this only removes an asymmetry between two 
near-identical methods.
   
   ### Why are the changes needed?
   
   `removeReason` was the only value in the tooltip escaped with 
`StringEscapeUtils.escapeEcmaScript` alone, without HTML escaping. That is a 
JavaScript string literal escape, so `\"` evaluates back to `"` at runtime. 
Since the timeline library treats the content as HTML, a reason like `"><img 
src=x onerror=alert(1)>` closes the `data-bs-title` attribute and injects a tag.
   
   The reason is not a fixed literal: it carries executor-side exception 
messages, YARN container diagnostics, and Kubernetes pod status messages 
verbatim.
   
   ### Does this PR introduce _any_ user-facing change?
   
   Yes. Removal reasons containing `<`, `>`, `&`, or `"` are now displayed as 
literal text instead of markup. Ordinary reasons render as before.
   
   ### How was this patch tested?
   
   Added `ExecutorEventEscapingSuite`, which feeds `"><img src=x 
onerror=alert(1)>` as the removal reason and asserts on the generated event for 
both pages. Verified it catches the regression: with no escaping it fails on 
`contained "<img"`, and with a single `Utility.escape` it fails on the missing 
double-escaped form.
   
   ```
   build/sbt 'core/testOnly org.apache.spark.ui.jobs.ExecutorEventEscapingSuite'
   ```
   
   ### Was this patch authored or co-authored using generative AI tooling?
   
   Generated-by: Claude Fable 5


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to