Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

orchestrator: prevent XSS attack via 'orchestrator-msg' params #7526

Merged
merged 1 commit into from
Feb 23, 2021
Merged

orchestrator: prevent XSS attack via 'orchestrator-msg' params #7526

merged 1 commit into from
Feb 23, 2021
+14 −1

Conversation

shlomi-noach
Copy link
Contributor

@shlomi-noach shlomi-noach commented Feb 21, 2021 •
edited by deepthi
Loading

Reported for both vitess and orchestrator, orchestrator allows a XSS attack via orchestrator-msg param. This PR sanitizes orchestrator-msg param.

related orchestrator PR: openark/orchestrator#1313

Checklist

  • Should this PR be backported?
  • Tests were added or are not required
  • Documentation was added or is not required

Impacted Areas in Vitess

Components that this PR will affect:

  • Query Serving
  • VReplication
  • Cluster Management
  • Build/CI
  • VTAdmin

@shlomi-noach
orchestrator: prevent XSS attack via 'orchestrator-msg' params
34d8201 
Signed-off-by: Shlomi Noach <2607934+shlomi-noach@users.noreply.github.com>
deepthi
deepthi approved these changes Feb 22, 2021
View reviewed changes
Copy link
Member

@deepthi deepthi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@deepthi deepthi requested review from doeg and rohit-nayak-ps and removed request for sougou February 22, 2021 20:18
@shlomi-noach shlomi-noach merged commit b76bfcf into vitessio:master Feb 23, 2021
@shlomi-noach shlomi-noach deleted the orcestrator-xss-msg branch February 23, 2021 04:16
@askdba askdba added this to the v10.0 milestone Feb 26, 2021
@ajm188 ajm188 mentioned this pull request Jul 14, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@deepthi deepthi deepthi approved these changes

@doeg doeg Awaiting requested review from doeg

@rohit-nayak-ps rohit-nayak-ps Awaiting requested review from rohit-nayak-ps

Assignees
No one assigned
Labels
Component: Cluster management
Projects
None yet
Milestone
v10.0
Development

Successfully merging this pull request may close these issues.
3 participants
@shlomi-noach @deepthi @askdba