IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Panel: Fully escape html in drilldown links (was only sanitized before) (#17731)

Browse Source 
* Sanitize HTML

* Replace sanitization lib and check for config

* Add htmlToText

* Refactor: Renaming htmlToText to escapeHtml
This commit is contained in:
Tobias Skarhed
2019-06-25 09:06:28 +02:00
committed by Torkel Ödegaard
parent 5713048f48
commit 75c29566a6
3 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
public/app/plugins/panel/text/module.ts
View File

@@ -1,7 +1,7 @@
import _ from 'lodash';
import { PanelCtrl } from 'app/plugins/sdk';
import Remarkable from 'remarkable';
import { sanitize } from 'app/core/utils/text';
import { sanitize, escapeHtml } from 'app/core/utils/text';
import config from 'app/core/config';
import { auto, ISCEService } from 'angular';
import { TemplateSrv } from 'app/features/templating/template_srv';
@@ -77,12 +77,8 @@ export class TextPanelCtrl extends PanelCtrl {
}
renderText(content: string) {
content = content
.replace(/&/g, '&')
.replace(/>/g, '>')
.replace(/</g, '&lt;')
.replace(/\n/g, '<br/>');
this.updateContent(content);
const safeContent = escapeHtml(content).replace(/\n/g, '<br/>');
this.updateContent(safeContent);
}
renderMarkdown(content: string) {