Sanitize PromLink button (#33874)

This commit is contained in:
Ivana Huckova 2021-05-10 21:07:51 +02:00 committed by GitHub
parent 5fd7c34420
commit 7b5223bf19
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 2 deletions

View File

@ -64,4 +64,16 @@ describe('PromLink', () => {
'prom2/graph?g0.expr=up&g0.range_input=0s&g0.end_input=undefined&g0.step_input=15&g0.tab=0'
);
});
it('should create sanitized link', async () => {
render(
<div>
<PromLink
datasource={getDataSource({ directUrl: "javascript:300?1:2;alert('Hello');//" })}
panelData={getPanelData()}
query={{} as PromQuery}
/>
</div>
);
expect(screen.getByText('Prometheus')).toHaveAttribute('href', 'about:blank');
});
});

View File

@ -3,7 +3,7 @@ import React, { FC, useEffect, useState, memo } from 'react';
import { PrometheusDatasource } from '../datasource';
import { PromQuery } from '../types';
import { DataQueryRequest, PanelData } from '@grafana/data';
import { DataQueryRequest, PanelData, textUtil } from '@grafana/data';
interface Props {
datasource: PrometheusDatasource;
@ -54,7 +54,7 @@ const PromLink: FC<Props> = ({ panelData, query, datasource }) => {
}, [datasource, panelData, query]);
return (
<a href={href} target="_blank" rel="noopener noreferrer">
<a href={textUtil.sanitizeUrl(href)} target="_blank" rel="noopener noreferrer">
Prometheus
</a>
);