IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-02-25 18:55:37 -06:00
Code Issues Packages Projects Releases Wiki Activity

Sanitize PromLink button (#33874)

Browse Source
This commit is contained in:
Ivana Huckova 2021-05-10 21:07:51 +02:00 committed by GitHub
parent 5fd7c34420
commit 7b5223bf19
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
View File

@ -64,4 +64,16 @@ describe('PromLink', () => {
'prom2/graph?g0.expr=up&g0.range_input=0s&g0.end_input=undefined&g0.step_input=15&g0.tab=0'
);
});
it('should create sanitized link', async () => {
render(
<div>
<PromLink
datasource={getDataSource({ directUrl: "javascript:300?1:2;alert('Hello');//" })}
panelData={getPanelData()}
query={{} as PromQuery}
/>
</div>
);
expect(screen.getByText('Prometheus')).toHaveAttribute('href', 'about:blank');
});
});

4
public/app/plugins/datasource/prometheus/components/PromLink.tsx
View File

@ -3,7 +3,7 @@ import React, { FC, useEffect, useState, memo } from 'react';
import { PrometheusDatasource } from '../datasource';
import { PromQuery } from '../types';
import { DataQueryRequest, PanelData } from '@grafana/data';
import { DataQueryRequest, PanelData, textUtil } from '@grafana/data';
interface Props {
datasource: PrometheusDatasource;
@ -54,7 +54,7 @@ const PromLink: FC<Props> = ({ panelData, query, datasource }) => {
}, [datasource, panelData, query]);
return (
<a href={href} target="_blank" rel="noopener noreferrer">
<a href={textUtil.sanitizeUrl(href)} target="_blank" rel="noopener noreferrer">
Prometheus
</a>
);