Stored XSS in Apache Ambari

An attacker with access to create or modify Ambari resources (e.g., services, hosts, alerts) can inject malicious JavaScript into a breadcrumb label. When a victim navigates to a page whose breadcrumb trail includes the crafted label, the unescaped label is rendered in the browser, executing the attacker's script. This is a stored cross-site scripting attack [CWE-79].

The vulnerability resides in `ambari-web/app/views/common/breadcrumbs_view.js`. The `createLabel()` method in `App.BreadcrumbItem` and the breadcrumb-building logic in `App.BreadcrumbsView` did not escape user-controllable label values before inserting them into the DOM, allowing stored XSS.

The patch adds `Ember.Handlebars.Utils.escapeExpression()` calls in two places. In `createLabel()`, the label retrieved via `labelBindingPath` is now escaped before being stored. In the breadcrumb-building loop, `items.slice(1).forEach(...)` escapes each item's label before the `BreadcrumbItem` is created. This ensures that any HTML or JavaScript injected into a breadcrumb label is rendered as safe text rather than executed.