1. Explain plan crashes query tool after SonarQube fixes.

2. Fix XSS issue in query tool.
3. Process details for cloud process not showing complete command.
4. Confirm dialog before removing processes.

web/pgadmin/misc/bgprocess/static/js/BgProcessNotify.jsx

@@ -28,6 +28,7 @@ const useStyles = makeStyles((theme)=>({
   },
   containerBody: {
     marginTop: '1rem',
+    overflowWrap: 'break-word',
   },
   containerSuccess: {
     borderColor: theme.palette.success.main,

web/pgadmin/misc/bgprocess/static/js/Processes.jsx

@@ -22,6 +22,7 @@ import HelpIcon from '@material-ui/icons/HelpRounded';
 import url_for from 'sources/url_for';
 import { Box } from '@material-ui/core';
 import { useMemo } from 'react';
+import Notifier from '../../../../static/js/helpers/Notifier';
 
 
 const useStyles = makeStyles((theme) => ({
@@ -251,6 +252,12 @@ export default function Processes() {
         sortOptions={[{id: 'stime', desc: true}]}
         getSelectedRows={(rows)=>{setSelectedRows(rows);}}
         isSelectRow={true}
+        tableProps={{
+          autoResetSelectedRows: false,
+          getRowId: (row)=>{
+            return row.id;
+          }
+        }}
         CustomHeader={()=>{
           return (
             <Box>
@@ -260,7 +267,9 @@ export default function Processes() {
                 aria-label="Acknowledge and Remove"
                 title={gettext('Acknowledge and Remove')}
                 onClick={() => {
-                  pgAdmin.Browser.BgProcessManager.acknowledge(selectedRows.map((p)=>p.original.id));
+                  Notifier.confirm(gettext('Remove Processes'), gettext('Are you sure you want to remove the selected processes?'), ()=>{
+                    pgAdmin.Browser.BgProcessManager.acknowledge(selectedRows.map((p)=>p.original.id));
+                  });
                 }}
                 disabled={selectedRows.length <= 0}
               ></PgIconButton>

web/pgadmin/misc/cloud/utils/__init__.py

@@ -84,7 +84,7 @@ class CloudProcessDesc(IProcessDesc):
 
         return {
             "message": self.message,
-            "cmd": cmd,
+            "cmd": self.cmd,
             "server": server,
             "object": self.instance_name,
             "type": self.provider,

web/pgadmin/static/js/Explain/Graphical.jsx

@@ -66,7 +66,7 @@ PolyLine.propTypes = {
 function Multitext({currentXpos, currentYpos, label, maxWidth}) {
   const theme = useTheme();
   let abc = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
-  var xmlns = 'https://www.w3.org/2000/svg';
+  var xmlns = 'http://www.w3.org/2000/svg';
   var svgElem = document.createElementNS(xmlns, 'svg');
   svgElem.setAttributeNS(xmlns, 'height', '100%');
   svgElem.setAttributeNS(xmlns, 'width', '100%');
@@ -295,7 +295,7 @@ function PlanSVG({planData, zoomFactor, fitZoomFactor, ...props}) {
   }, [planData.width]);
 
   return (
-    <svg height={planData.height*zoomFactor} width={planData.width*zoomFactor} version="1.1" xmlns="https://www.w3.org/2000/svg">
+    <svg height={planData.height*zoomFactor} width={planData.width*zoomFactor} version="1.1" xmlns="http://www.w3.org/2000/svg">
       <defs>
         {Object.keys(props.ctx.arrows).map((arr_id, i)=>{
           let arrowPoints = [

web/pgadmin/static/js/components/PgTable.jsx

@@ -213,7 +213,7 @@ IndeterminateCheckbox.propTypes = {
 };
 
 const ROW_HEIGHT = 35;
-export default function PgTable({ columns, data, isSelectRow, caveTable=true, schema, ExpandedComponent, sortOptions, ...props }) {
+export default function PgTable({ columns, data, isSelectRow, caveTable=true, schema, ExpandedComponent, sortOptions, tableProps, ...props }) {
   // Use the state and functions returned from useTable to build your UI
   const classes = useStyles();
   const [searchVal, setSearchVal] = React.useState('');
@@ -269,10 +269,10 @@ export default function PgTable({ columns, data, isSelectRow, caveTable=true, sc
       defaultColumn,
       isSelectRow,
       autoResetSortBy: false,
-      autoResetSelectedRows: false,
       initialState: {
         sortBy: sortOptions || [],
-      }
+      },
+      ...tableProps,
     },
     useGlobalFilter,
     useSortBy,
@@ -550,5 +550,6 @@ PgTable.propTypes = {
   schema: PropTypes.object,
   rows: PropTypes.object,
   ExpandedComponent: PropTypes.node,
+  tableProps: PropTypes.object,
   'data-test': PropTypes.string
 };

web/pgadmin/static/js/helpers/Notifier.jsx

@@ -76,7 +76,7 @@ export function initializeModalProvider(modalContainer) {
 }
 
 const FinalNotifyContent = React.forwardRef(({children}, ref) => {
-  return <SnackbarContent style= {{justifyContent:'end'}} ref={ref}>{children}</SnackbarContent>;
+  return <SnackbarContent style= {{justifyContent:'end', maxWidth: '700px'}} ref={ref}>{children}</SnackbarContent>;
 });
 FinalNotifyContent.displayName = 'FinalNotifyContent';
 FinalNotifyContent.propTypes = {

web/pgadmin/tools/sqleditor/__init__.py

@@ -39,7 +39,7 @@ from pgadmin.utils.ajax import make_json_response, bad_request, \
 from pgadmin.utils.driver import get_driver
 from pgadmin.utils.exception import ConnectionLost, SSHTunnelConnectionLost, \
     CryptKeyMissing, ObjectGone
-from pgadmin.browser.utils import underscore_unescape
+from pgadmin.browser.utils import underscore_unescape, underscore_escape
 from pgadmin.utils.menu import MenuItem
 from pgadmin.utils.sqlautocomplete.autocomplete import SQLAutoComplete
 from pgadmin.tools.sqleditor.utils.query_tool_preferences import \
@@ -286,7 +286,7 @@ def panel(trans_id):
 
     close_url = ''
     if request.form:
-        params['title'] = underscore_unescape(request.form['title'])
+        params['title'] = request.form['title']
         close_url = request.form['close_url']
         if 'sql_filter' in request.form:
             params['sql_filter'] = request.form['sql_filter']
@@ -317,16 +317,17 @@ def panel(trans_id):
             params['bgcolor'] = s.bgcolor
         params['fgcolor'] = s.fgcolor or 'black'
 
-    params['server_name'] = s.name
+    params['server_name'] = underscore_escape(s.name)
-    params['username'] = s.username
+    params['username'] = underscore_escape(s.username)
     params['layout'] = get_setting('SQLEditor/Layout')
     params['macros'] = get_user_macros()
     params['is_desktop_mode'] = current_app.PGADMIN_RUNTIME
+    params['database_name'] = underscore_escape(params['database_name'])
 
     return render_template(
         "sqleditor/index.html",
         close_url=close_url,
-        title=params['title'],
+        title=underscore_unescape(params['title']),
         params=json.dumps(params),
         requirejs=True,
         basejs=True,

web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx

@@ -100,16 +100,16 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN
       sgid: params.sgid,
       sid: params.sid,
       did: params.did,
-      user: params.username,
+      user: _.unescape(params.username),
       role: null,
       title: _.unescape(params.title),
       fgcolor: params.fgcolor,
       bgcolor: params.bgcolor,
       conn_title: getTitle(
-        pgAdmin, null, selectedNodeInfo, true, params.server_name, params.database_name || getDatabaseLabel(selectedNodeInfo),
+        pgAdmin, null, selectedNodeInfo, true, _.unescape(params.server_name), _.unescape(params.database_name) || getDatabaseLabel(selectedNodeInfo),
-        params.username, params.is_query_tool == 'true' ? true : false),
+        _.unescape(params.username), params.is_query_tool == 'true' ? true : false),
-      server_name: params.server_name,
+      server_name: _.unescape(params.server_name),
-      database_name: params.database_name || getDatabaseLabel(selectedNodeInfo),
+      database_name: _.unescape(params.database_name) || getDatabaseLabel(selectedNodeInfo),
       is_selected: true,
     }],
   });

web/pgadmin/tools/sqleditor/static/js/sqleditor_title.js

@@ -15,7 +15,7 @@ import { retrieveNameSpaceName, retrieveNodeName } from './show_view_data';
 const pgAdmin = pgWindow.pgAdmin;
 
 export function getDatabaseLabel(parentData) {
-  return parentData.database ? parentData.database.label
+  return parentData.database ? parentData.database._label
     : parentData.server?.db;
 }
 
@@ -74,7 +74,7 @@ export function getPanelTitle(pgBrowser, selected_item=null, custom_title=null,
   var title_data = {
     'database': db_label,
     'username': parentData.server.user.name,
-    'server': parentData.server.label,
+    'server': parentData.server._label,
     'type': 'query_tool',
   };
 
@@ -132,7 +132,7 @@ export function generateTitle(title_placeholder, title_data) {
     title_placeholder = title_placeholder.replace('%DATABASE%', _.unescape(title_data.database));
   }
 
-  return _.escape(title_placeholder);
+  return title_placeholder;
 }
 
 /*

web/regression/javascript/search_objects/search_objects_dialog_spec.js

@@ -82,6 +82,7 @@ describe('SearchObjectsDialog', () => {
                 _type: 'server',
                 user: {name: 'username'},
                 label: 'theserver',
+                _label: 'theserver',
               },
               children: [
                 {
@@ -90,6 +91,7 @@ describe('SearchObjectsDialog', () => {
                     _type: 'database',
                     _id: 11,
                     label: 'thedatabase',
+                    _label: 'thedatabase',
                   },
                 },
               ],