WeiYe-Jing / datax-web

DataX集成可视化页面,选择数据源即可一键生成数据同步任务,支持RDBMS、Hive、HBase、ClickHouse、MongoDB等数据源,批量创建RDBMS数据同步任务,集成开源调度系统,支持分布式、增量同步数据、实时查看运行日志、监控执行器资源、KILL运行进程、数据源信息加密等。
https://segmentfault.com/u/weiye_jing/articles
MIT License
5.55k stars 2.14k forks source link

[BUG] Security Vulnerability - Action Required: XSS vulnerability in the newest version of the datax-web #652

Open Crispy-fried-chicken opened 7 months ago

Crispy-fried-chicken commented 7 months ago

Describe the bug I think your project allows Stored XSS (in Add User) to bypass the 20-character limit via datax-admin/src/main/java/com/wugui/datax/admin/controller/UserController.java#L27. It shares similarities to a recent CVE disclosure CVE-2020-29204 in thexuxueli/xxl-job.

The source vulnerability information is as follows:

Vulnerability Detail: CVE Identifier: CVE-2020-29204 Description: XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java. Reference:https://nvd.nist.gov/vuln/detail/CVE-2020-29204 Patch: https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e

To Reproduce The reproduce step may be similiar to the xxl-job(https://github.com/xuxueli/xxl-job/issues/2083)

Expected behavior Add User

Which version of DataX Web: the newest version

**Requirement or improvement The corresponding fixes are similar to CVE-2020-29204 to some extent. You can follow the patch of CVE-2020-29204 to fix it.