[GitHub] [incubator-superset] magentomaniac commented on issue #9738: Add simple javascript for conditional formatting of cells in Table Chart

[GitBox <gi...@apache.org>]

magentomaniac commented on issue #9738:
URL: https://github.com/apache/incubator-superset/issues/9738#issuecomment-666495091


   I believe I finally found a way to run arbitrary Javascript using the markdown element. Couldn't get this to work using any official methods including markup chart visualization - which simply refuses to be added to dashboards.
   
   On your dashboard click "edit dashboard" and drag&drop the mardown element anywhere. Click on it on edit.
   Paste the following markdown to run a small piece of arbitrary javascript and confirm it's possible to get it working:
   
   <p>Chart title</p>
   <img src=";" onerror="alert(0);" />
   
   Since this format is limited by wrapping in double-quotes it's best to attach your javascript from an external source, like so:
   ![Screen Shot 2020-07-30 at 17 07 06](https://user-images.githubusercontent.com/27358520/88946531-48156100-d287-11ea-9987-d58d26a48ea1.png)
   
   It's a hack (literally abusing a XSS attack vector) but it's the only way I could find that works. Hope this helps.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org