dongjoon-hyun opened a new pull request, #57288: URL: https://github.com/apache/spark/pull/57288
### What changes were proposed in this pull request? This PR HTML-escapes the executor removal reason before embedding it into the executor event timeline tooltip, in both `AllJobsPage` and `JobPage`. `Utility.escape` is applied twice, matching the adjacent job description and stage name handling (`jsEscapedDescForTooltip` / `jsEscapedNameForTooltip`): the value is parsed once as the `data-bs-title` attribute value, and once more when Bootstrap assigns it as the tooltip `innerHTML`. It also drops `private` from `AllJobsPage.makeExecutorEvent` so the new test can call it. `JobPage.makeExecutorEvent` is already non-private, and both classes are `private[ui]`, so this only removes an asymmetry between two near-identical methods. ### Why are the changes needed? `removeReason` was the only value in the tooltip escaped with `StringEscapeUtils.escapeEcmaScript` alone, without HTML escaping. That is a JavaScript string literal escape, so `\"` evaluates back to `"` at runtime. Since the timeline library treats the content as HTML, a reason like `"><img src=x onerror=alert(1)>` closes the `data-bs-title` attribute and injects a tag. The reason is not a fixed literal: it carries executor-side exception messages, YARN container diagnostics, and Kubernetes pod status messages verbatim. ### Does this PR introduce _any_ user-facing change? Yes. Removal reasons containing `<`, `>`, `&`, or `"` are now displayed as literal text instead of markup. Ordinary reasons render as before. ### How was this patch tested? Added `ExecutorEventEscapingSuite`, which feeds `"><img src=x onerror=alert(1)>` as the removal reason and asserts on the generated event for both pages. Verified it catches the regression: with no escaping it fails on `contained "<img"`, and with a single `Utility.escape` it fails on the missing double-escaped form. ``` build/sbt 'core/testOnly org.apache.spark.ui.jobs.ExecutorEventEscapingSuite' ``` ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Fable 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
