[VOTE] Release Apache Atlas version 2.1.0 - rc1

2020-06-06 Thread Madhan Neethiraj
Atlas team, Apache Atlas 2.1.0 rc1, with following fixes since rc0, is now available for vote within dev community.     ATLAS-3770: UI(Classic): Active and Deleted hyperlinks for certain entities throwing error on click     ATLAS-3766: Stats modal not close issue #2     ATLAS-3674: ZipF

[VOTE] Release Apache Atlas version 2.1.0 - rc1

2020-06-06 Thread Madhan Neethiraj
(resending with plain-text format) Atlas team,   Apache Atlas 2.1.0 rc1, with following fixes since rc0, is now available for vote within dev community.       ATLAS-3770: UI(Classic): Active and Deleted hyperlinks for certain entities throwing error on click     ATLAS-3766: Stats modal not close

Re: [VOTE] Release Apache Atlas version 2.1.0 - rc1

2020-06-06 Thread Bolke de Bruin
Hi Madhan, Melinda Crane of Snapchat raised some concerns over XSS issues that have gone unanswered. Particularly: 1. the CSP allows unsafe-inline and unsafe-eval 2. the backend JSON content provider doesn't appear to do any sort of force escaping on HTML sensitive characters webapp/src/main/j

Re: Seeking advice on Atlas XSS vulnerabilities

2020-06-06 Thread Madhan Neethiraj
Melinda, Thank you for reaching out to Apache Atlas community. As you noted, AtlasJsonProvider is used to deserialize/serialize REST API requests and responses. In addition, methods in AtlasJson are used in to convert to/from Json. It will help if you can add few examples of potential issues w