diff --git a/public/app/features/plugins/sandbox/distortion_map.ts b/public/app/features/plugins/sandbox/distortion_map.ts index 2989172874d1..dac4301cbde1 100644 --- a/public/app/features/plugins/sandbox/distortion_map.ts +++ b/public/app/features/plugins/sandbox/distortion_map.ts @@ -204,7 +204,10 @@ function distortInnerHTML(distortions: DistortionMap) { const pluginId = meta.id; return function innerHTMLDistortion(this: HTMLElement, ...args: string[]) { for (const arg of args) { - const lowerCase = arg?.toLowerCase() || ''; + // NOTE: DOMPurify anti-tamper mechanism requires us to clone the string + // calling any method whatsoever on a string will cause the string to be tampered + // and DOMPurify will return empty strings + const lowerCase = String(arg || '').toLowerCase(); for (const forbiddenElement of forbiddenElements) { if (lowerCase.includes('<' + forbiddenElement)) { logWarning(`Plugin ${pluginId} tried to set ${forbiddenElement} in innerHTML`, { @@ -223,7 +226,7 @@ function distortInnerHTML(distortions: DistortionMap) { } if (isFunction(originalMethod)) { - originalMethod.apply(this, args); + return originalMethod.apply(this, args); } }; }