mirror of
https://github.com/grafana/grafana.git
synced 2025-02-25 18:55:37 -06:00
Sanitize PromLink button (#33874)
This commit is contained in:
parent
5fd7c34420
commit
7b5223bf19
@ -64,4 +64,16 @@ describe('PromLink', () => {
|
||||
'prom2/graph?g0.expr=up&g0.range_input=0s&g0.end_input=undefined&g0.step_input=15&g0.tab=0'
|
||||
);
|
||||
});
|
||||
it('should create sanitized link', async () => {
|
||||
render(
|
||||
<div>
|
||||
<PromLink
|
||||
datasource={getDataSource({ directUrl: "javascript:300?1:2;alert('Hello');//" })}
|
||||
panelData={getPanelData()}
|
||||
query={{} as PromQuery}
|
||||
/>
|
||||
</div>
|
||||
);
|
||||
expect(screen.getByText('Prometheus')).toHaveAttribute('href', 'about:blank');
|
||||
});
|
||||
});
|
||||
|
@ -3,7 +3,7 @@ import React, { FC, useEffect, useState, memo } from 'react';
|
||||
|
||||
import { PrometheusDatasource } from '../datasource';
|
||||
import { PromQuery } from '../types';
|
||||
import { DataQueryRequest, PanelData } from '@grafana/data';
|
||||
import { DataQueryRequest, PanelData, textUtil } from '@grafana/data';
|
||||
|
||||
interface Props {
|
||||
datasource: PrometheusDatasource;
|
||||
@ -54,7 +54,7 @@ const PromLink: FC<Props> = ({ panelData, query, datasource }) => {
|
||||
}, [datasource, panelData, query]);
|
||||
|
||||
return (
|
||||
<a href={href} target="_blank" rel="noopener noreferrer">
|
||||
<a href={textUtil.sanitizeUrl(href)} target="_blank" rel="noopener noreferrer">
|
||||
Prometheus
|
||||
</a>
|
||||
);
|
||||
|
Loading…
Reference in New Issue
Block a user