Some malformed and unquoted HTML strings are returned from datanode web ui

When browsing to the datanode at /browseDirectory.jsp, if a path with HTML characters is requested, the resulting error page echos back the input unquoted.

Example:

http://localhost:50075/browseDirectory.jsp?dir=/<xss>&go=go&namenodeInfoPort=50070&nnaddr=localhost%3A9000

Writes an input element as part of the response:

<input name="dir" type="text" width="50" id"dir" value="/<xss>">

• The value of the "value" attribute is not quoted.
• An = must follow the "id" attribute name.
• Element "input" should have a closing tag.

The output should be something like:

<input name="dir" type="text" width="50" id="dir" value="/<xss>"/>

In addition, if one creates a directory:

hdfs dfs -put '/some/path/to/<xss>'

Then browsing to the parent of directory '<xss>' prints unquoted HTML in the directory names.