You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@echarts.apache.org by su...@apache.org on 2021/01/21 07:08:08 UTC
[echarts] 03/03: fix: add encode html to avoid xss risk.
This is an automated email from the ASF dual-hosted git repository.
sushuang pushed a commit to branch fix/encodehtml
in repository https://gitbox.apache.org/repos/asf/echarts.git
commit 97db80ac62988ea5cd7db68962d24312eeab57b6
Author: 100pah <su...@gmail.com>
AuthorDate: Thu Jan 21 15:07:00 2021 +0800
fix: add encode html to avoid xss risk.
---
src/component/tooltip/tooltipMarkup.ts | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/component/tooltip/tooltipMarkup.ts b/src/component/tooltip/tooltipMarkup.ts
index b59be65..2e88c1d 100644
--- a/src/component/tooltip/tooltipMarkup.ts
+++ b/src/component/tooltip/tooltipMarkup.ts
@@ -58,9 +58,12 @@ function getTooltipTextStyle(
const valueFontWeight = textStyle.fontWeight || '900';
if (renderMode === 'html') {
+ // `textStyle` is probably from user input, should be encoded to reduce security risk.
return {
- nameStyle: `font-size:${nameFontSize}px;color:${nameFontColor};font-weight:${nameFontWeight}`,
- valueStyle: `font-size:${valueFontSize}px;color:${valueFontColor};font-weight:${valueFontWeight}`
+ // eslint-disable-next-line max-len
+ nameStyle: `font-size:${encodeHTML(nameFontSize + '')}px;color:${encodeHTML(nameFontColor)};font-weight:${encodeHTML(nameFontWeight + '')}`,
+ // eslint-disable-next-line max-len
+ valueStyle: `font-size:${encodeHTML(valueFontSize + '')}px;color:${encodeHTML(valueFontColor)};font-weight:${encodeHTML(valueFontWeight + '')}`
};
}
else {
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org