[
https://issues.apache.org/jira/browse/GEODE-10612?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111866#comment-18111866
]
ASF subversion and git services commented on GEODE-10612:
---------------------------------------------------------
Commit 551d1748c50e620111b566ed69ffe7bf8fe67184 in geode's branch
refs/heads/support/2.0 from Jinwoo Hwang
[ https://gitbox.apache.org/repos/asf?p=geode.git;h=551d1748c5 ]
[GEODE-10614] Preparation of release 2.0.3 (#8055)
* [GEODE-10619] Remediation of CVE-2026-59296: Micrometer 1.15.12 to 1.16.7
(#8044)
* [GEODE-10621] Remediation of CVE-2026-19032: Jackson 2.21.5 to 2.21.6 (#8048)
* [GEODE-10622] Remediation of CVE-2026-47857: Reactor Core 3.6.10 to 3.8.7
(#8049)
* [GEODE-10618] Make named-query endpoint permissions consistent with region
data endpoints (#8043)
* GEODE-10613: Add configurable export directories for export data (#8042)
* GEODE-10612: Encode region path in Pulse region-detail error messages (#8041)
When a region-detail request names a path that does not resolve, the
region services return "Region [<path>] is not available" in the
errorOnRegion field, which the Pulse UI displays. Paths containing
characters such as '<' or '&' did not display correctly.
* GEODE-10626: Add configurable output directories for export data (#8037)
* GEODE-10624: Validate interest result policy message part before decoding
(#8053)
Read the register-interest policy part in the fixed-identifier form the
client sends it in, and refuse a part in any other form before decoding.
Adds unit and integration coverage for the policy part handling.
* [GEODE-10623] Remediation of CVE-2026-64607: HttpClient5 5.4.4 to 5.6.4
(#8050)
> Pulse region-detail error message does not display the requested region path
> correctly
> --------------------------------------------------------------------------------------
>
> Key: GEODE-10612
> URL: https://issues.apache.org/jira/browse/GEODE-10612
> Project: Geode
> Issue Type: Improvement
> Reporter: Jinwoo Hwang
> Assignee: Jinwoo Hwang
> Priority: Major
>
> When the region-detail page is opened for a path that does not resolve to an
> existing region, Pulse displays:
> Region [<path>] is not available
> The path comes from the page URL and is inserted into that message, and the
> message is rendered into the page as HTML. Characters that are significant in
> HTML - '<', '>', '&', quotes - are therefore consumed by the browser instead
> of
> being shown, so the operator sees an altered or truncated path rather than the
> one that was actually requested. That makes the message misleading in exactly
> the situation where it needs to be precise: telling the operator which path
> could not be found.
> Steps to reproduce
> ------------------
> 1. Start a locator with the HTTP service enabled and log in to Pulse.
> 2. Open a region-detail URL whose path contains an HTML character, e.g.
> /pulse/regionDetail.html?regionFullPath=%2Forders%3C2026%3E
> 3. Observe the "is not available" message.
> Expected: Region [/orders<2026>] is not available
> Actual: the "<2026>" portion is missing from the displayed path
> Notes
> -----
> Region names themselves are restricted to alphanumeric characters, hyphens and
> underscores (RegionNameValidation), so this only affects paths that do not
> correspond to an existing region - which is precisely the case this message
> exists to report. It is reachable through stale or externally generated links,
> such as a bookmarked region-detail URL for a region that has since been
> destroyed, or a link constructed by external tooling.
> Two services build this message and both are affected:
> - ClusterSelectedRegionService
> - ClusterSelectedRegionsMemberService
> Suggested fix
> -------------
> Encode the path for the HTML context when building the message. The region
> lookup should continue to use the path exactly as supplied, so that resolution
> behaviour is unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
