You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@echarts.apache.org by wa...@apache.org on 2024/06/18 10:48:11 UTC
(echarts) 01/01: fix(tooltip): fix tooltip XSS issue when legend name is HTML string
This is an automated email from the ASF dual-hosted git repository.
wangzx pushed a commit to branch fix/tooltip-xss
in repository https://gitbox.apache.org/repos/asf/echarts.git
commit ad947d661526dd0a64d7ee55fbd200478381a3cc
Author: plainheart <yh...@all-my-life.cn>
AuthorDate: Tue Jun 18 18:45:50 2024 +0800
fix(tooltip): fix tooltip XSS issue when legend name is HTML string
---
src/util/graphic.ts | 4 +++-
test/tooltip.html | 51 ++++++++++++++++++++++++++++-----------------------
2 files changed, 31 insertions(+), 24 deletions(-)
diff --git a/src/util/graphic.ts b/src/util/graphic.ts
index a7e26e1d9..d98cf674c 100644
--- a/src/util/graphic.ts
+++ b/src/util/graphic.ts
@@ -67,6 +67,7 @@ import {
} from 'zrender/src/core/util';
import { getECData } from './innerStore';
import ComponentModel from '../model/Component';
+import { encodeHTML } from 'zrender/src/core/dom';
import {
@@ -600,10 +601,11 @@ export function setTooltipConfig(opt: {
const ecData = getECData(opt.el);
ecData.componentMainType = mainType;
ecData.componentIndex = componentIndex;
+
ecData.tooltipConfig = {
name: itemName,
option: defaults({
- content: itemName,
+ content: encodeHTML(itemName),
formatterParams: formatterParams
}, itemTooltipOptionObj)
};
diff --git a/test/tooltip.html b/test/tooltip.html
index 8f3a55ea0..d80804e8b 100644
--- a/test/tooltip.html
+++ b/test/tooltip.html
@@ -66,8 +66,8 @@ under the License.
<div class="chart" id="positionSpecified"></div>
<!--<h1>alwaysShowContent (check when hover on the last one, the content should not be the previous one)</h1>-->
<!--<div class="chart" id="alwaysShowContent"></div>-->
-
-
+ <h1>Tooltip shouldn't render legend name as HTML element by default</h1>
+ <div class="chart" id="tooltip-legend-xss"></div>
@@ -785,34 +785,39 @@ under the License.
<script>
require(['echarts'], function (echarts) {
-
var option = {
tooltip: {
- trigger: 'axis',
- triggerOn: 'click',
- axisPointer: {
- type: 'cross'
- }
- }
- };
- var baseTop = 90;
- var height = 150;
- var gap = 50;
- makeCategoryGrid(option, {
- grid: {top: baseTop, height: height},
- yAxis: {
- name: 'click show tip',
+ trigger: 'axis'
+ },
+ legend: {
+ data: ['<img onerror=alert(1)/>'],
tooltip: {
show: true
}
- }
- });
- baseTop += height + gap;
-
- createChart('click', echarts, option, baseTop);
+ },
+ xAxis: {
+ type: 'category',
+ data: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat', 'Sun']
+ },
+ yAxis: {},
+ series: [
+ {
+ name: '<img onerror=alert(1)/>',
+ type: 'line',
+ stack: 'Total',
+ areaStyle: {},
+ emphasis: {
+ focus: 'series'
+ },
+ data: [220, 182, 191, 234, 290, 330, 310]
+ }
+ ]
+ };
+ createChart('tooltip-legend-xss', echarts, option, 500);
})
</script>
</body>
-</html>
\ No newline at end of file
+</html>
+
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@echarts.apache.org
For additional commands, e-mail: commits-help@echarts.apache.org