Consumer Group Id is not html escaped in the UI about kafdrop HOT 5 OPEN

Hey @davideicardi,

I tried to investigate this issue and following are my findings,

• For consumer group ID with HTML content is being rendered by UI, html tags can be seen.
• However going into consumer detail page it is failing due to NoResourceFoundException
• Escaping HTML from groupId in topic response won't help as spring.url will again convert it as unescaped one.
• It would be better to send it in post request rather then get, to solve this problem.

I started looking into the code recently, I could be wrong with my analysis. Feel free to correct me and guide for the same.

Looking forward to contribute more with this project. Let me know if any further investigation is required.

from kafdrop.

Thank you @aakashthakare!
Regarding the resource not found, it is a problem of the id pased in the wrong way? Or maybe some other server side problems?

from kafdrop.

Hello @davideicardi, thanks for the response. Yes, need to fix from server side. The URL consumer/my-second-consumer-group-<a>new</a> failing to reach the controller, We need to HTML encode it in URL, while on the server side we need to HTML decode the consumer id.

from kafdrop.

What if you pass it as URL encoded? (not HTML encoded ...)

from kafdrop.

It will solve upto some extent, not completely.

For example, consumer group id is test-<a>it</a>, if URL encoded will become test-%3Ca%3Eit%3C%2Fa%3E, this we can do while returning the consumer group. However, it gets automatically decoded when clicked on consumer link consumer/test-%3Ca%3Eit%3C%2Fa%3E, and we get A 404 error has occurred: No static resource consumer/test-<a>it</a>.

One way is to do Bse64 encoding/decoding of the groupId, but need to see how we can decode it to display the readable consumer id. Check out this commit.

from kafdrop.