[CVE-2020-13944] Apache Airflow Reflected XSS via Origin Parameter <= 1.10.12

[Kaxil Naik <kaxilnaik () gmail com>]

Versions Affected: <= 1.10.12
Description:
The "origin" parameter passed to some of the endpoints like '/trigger' was
vulnerable to XSS exploit.

Credit:
The issue was independently discovered and reported by Ali Al-Habsi of
Accellion & Everardo Padilla Saca.

Thanks,
Kaxil,
on behalf of Apache Airflow PMC