iop
/
superset
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Safely passing data to d3.html (#4842)

This commit is contained in:
michellethomas 2018-04-22 21:00:37 -07:00 committed by Maxime Beauchemin
parent 937a5bc85c
commit 370d8a2bbe
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
superset/assets/src/visualizations/big_number.js
View File

@ -1,5 +1,6 @@
import d3 from 'd3';
import d3tip from 'd3-tip';
import dompurify from 'dompurify';
import { d3FormatPreset, d3TimeFormatPreset } from '../modules/utils';
import './big_number.css';
@ -153,7 +154,7 @@ function bigNumberVis(slice, payload) {
const renderTooltip = (d) => {
const date = formatDate(d[0]);
const value = f(d[1]);
const value = dompurify.sanitize(f(d[1]));
return `
<div>
<span style="margin-right: 10px;">${date}: </span>

3
superset/assets/src/visualizations/nvd3_vis.js
View File

@ -7,6 +7,7 @@ import 'nvd3/build/nv.d3.min.css';
import mathjs from 'mathjs';
import moment from 'moment';
import d3tip from 'd3-tip';
import dompurify from 'dompurify';
import { getColorFromScheme } from '../modules/colors';
import AnnotationTypes, {
@ -448,7 +449,7 @@ export default function nvd3Vis(slice, payload) {
`style="border: 2px solid ${series.highlight ? 'black' : 'transparent'}; background-color: ${series.color};"` +
'></div>' +
'</td>' +
`<td>${series.key}</td>` +
`<td>${dompurify.sanitize(series.key)}</td>` +
`<td>${yAxisFormatter(series.value)}</td>` +
'</tr>'
);

3
superset/assets/src/visualizations/table.js
View File

@ -1,6 +1,7 @@
import d3 from 'd3';
import dt from 'datatables.net-bs';
import 'datatables.net-bs/css/dataTables.bootstrap.css';
import dompurify from 'dompurify';
import { fixDataTableBodyHeight, d3TimeFormatPreset } from '../modules/utils';
import './table.css';
@ -87,7 +88,7 @@ function tableVis(slice, payload) {
html = tsFormatter(val);
}
if (typeof (val) === 'string') {
html = `<span class="like-pre">${val}</span>`;
html = `<span class="like-pre">${dompurify.sanitize(val)}</span>`;
}
if (isMetric) {
html = slice.d3format(c, val);