[jira] [Commented] (ATLAS-5370) Atlas UI : Encode text in D3 graph tooltips Lineage and Profile charts

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ATLAS-5370?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103344#comment-18103344 ] 

ASF subversion and git services commented on ATLAS-5370:
--------------------------------------------------------

Commit b4e8f06cdc377dedd400f99ed07cf7abfa55ee3a in atlas's branch refs/heads/ATLAS-5370 from Prasad Pawar
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=b4e8f06cd ]

ATLAS-5370: Atlas UI : Encode text in D3 graph tooltips Lineage and Profile charts


> Atlas UI : Encode text in D3 graph tooltips Lineage and Profile charts
> ----------------------------------------------------------------------
>
>                 Key: ATLAS-5370
>                 URL: https://issues.apache.org/jira/browse/ATLAS-5370
>             Project: Atlas
>          Issue Type: Bug
>          Components: atlas-webui
>    Affects Versions: 3.0.0
>            Reporter: Prasad P. Pawar
>            Assignee: Prasad P. Pawar
>            Priority: Major
>
> User-provided or API-sourced text shown in D3-based tooltips was inserted into tooltip HTML without encoding. Special characters (e.g. {{{}<{}}}, {{{}>{}}}, {{{}&{}}}, quotes) could cause incorrect tooltip rendering or unexpected HTML behavior in the browser.
> Affected areas
>  * Lineage graph — React UI and classic UI (atlas-lineage library)
>  * Profile bar chart — classic UI only ({{{}ProfileBarChart.js{}}})
> Root cause
> Both components use {{d3-tip}} with {{{}.html(){}}}, which assigns content via {{{}innerHTML{}}}. Values such as entity display names, type names, query text, and profile chart labels were concatenated directly into HTML strings without encoding.
> Solution
>  * Introduced a shared {{escapeHtml()}} helper in atlas-lineage Utils
>  * Applied encoding to all dynamic tooltip fields before HTML assembly
>  * Applied the same pattern to Profile bar chart tooltips ({{{}d.value{}}}, chart type, {{{}d.count{}}})
>  * Rebuilt the legacy atlas-lineage webpack bundle for classic UI
> Testing
>  * Unit tests for {{escapeHtml}} (special characters, null/undefined, plain text)
>  * React dashboard build verification
>  * Apache RAT license check on new/changed files
>  * Manual verification: hover lineage nodes and profile chart bars; confirm tooltips render user text correctly
> Out of scope
>  * MUI/Recharts tooltips (already use React text nodes)
>  * Components using {{sanitizeHtmlContent}} (e.g. HtmlRenderer, Business Metadata tab)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)