[GitHub] [echarts] 100pah edited a comment on issue #14429: tooltips xss问题

[GitBox <gi...@apache.org>]

100pah edited a comment on issue #14429:
URL: https://github.com/apache/echarts/issues/14429#issuecomment-794847914


   I think it is not an issue.
   When the `tooltip.formatter` is totally defined by user,
   user should do that `encodeHTML` when assemble html text.  
   For example: 
   
   ```js
       tooltip: {
           trigger: 'axis',
           formatter(params) {
               const name = params[0] && params[0].name;
               const fmt = `${name}${
                   params.map((param, i) => {
   
                   return `<br/>
                         <span class="serie-label" style="display:inline-block;margin-right:5px;border-radius:10px;width:10px;height:10px;
                           background-color:${param.color};"></span>
                       ${encodeHTML(param.seriesName)} : ${encodeHTML(param.value)}`;
               }).join('')
             }`;
   
             return fmt
   
           }
       }
   ```
   
   
   ```js
   function encodeHTML(source) {
       return source == null
           ? ''
           : (source + '').replace(/([&<>"'])/g, function (str, c) {
               return {
                   '&': '&amp;',
                   '<': '&lt;',
                   '>': '&gt;',
                   '"': '&quot;',
                   '\'': '&#39;'
               }[c];
           });
   }
   
   ```
   
   echarts should not make `param.seriesName` and `param.value` encoded internally, because:
   (1) If echarts encode them internally, users can only get the encoded `param.seriesName` and `param.value` and can not do anything others to that string.
   (2) `encodeHTML` only make sense in html tooltip ([renderMode: html](https://echarts.apache.org/en/option.html#tooltip.renderMode)), but if `renderMode` is `richText`, we can not make the encoded string display correctly


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org