[GitHub] [echarts] 100pah commented on issue #14429: tooltips xss问题

[GitBox <gi...@apache.org>]

100pah commented on issue #14429:
URL: https://github.com/apache/echarts/issues/14429#issuecomment-794847914


   I think it is not an issue.
   When the `tooltip.formatter` is totally defined by user,
   user should do that `encodeHTML` when assemble html text.  
   For example: 
   
   ```js
       tooltip: {
           trigger: 'axis',
           formatter(params) {
               const name = params[0] && params[0].name;
               const fmt = `${name}${
                   params.map((param, i) => {
   
                   return `<br/>
                         <span class="serie-label" style="display:inline-block;margin-right:5px;border-radius:10px;width:10px;height:10px;
                           background-color:${param.color};"></span>
                       ${encodeHTML(param.seriesName)} : ${encodeHTML(param.value)}`;
               }).join('')
             }`;
   
             return fmt
   
           }
       }
   ```
   
   
   ```js
   function encodeHTML(source) {
       return source == null
           ? ''
           : (source + '').replace(/([&<>"'])/g, function (str, c) {
               return {
                   '&': '&amp;',
                   '<': '&lt;',
                   '>': '&gt;',
                   '"': '&quot;',
                   '\'': '&#39;'
               }[c];
           });
   }
   
   ```
   
   echarts should not make `param.seriesName` and `param.value` encoded internally, 
   otherwise, users can only get the encoded `param.seriesName` and `param.value` and can not do anything others to that string.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org