IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-26 13:27:30 -05:00
Code Issues Packages Projects Releases Wiki Activity

FE Sandbox: Fix innerHTML distortion causing issues with DOMPurify inner works (#87117)

Browse Source 
* FE Sandbox: Fix innerHTML distortion causing issues with DOMPurify inner works

* Add a comment explaining the fix
This commit is contained in:
Esteban Beltran
2024-05-02 11:17:04 +02:00
committed by GitHub
parent a59e7e14b1
commit 9f5ab38477
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/app/features/plugins/sandbox/distortion_map.ts
+5 -2
View File
@@ -204,7 +204,10 @@ function distortInnerHTML(distortions: DistortionMap) {
const pluginId = meta.id; const pluginId = meta.id;
return function innerHTMLDistortion(this: HTMLElement, ...args: string[]) { return function innerHTMLDistortion(this: HTMLElement, ...args: string[]) {
for (const arg of args) { for (const arg of args) {
const lowerCase = arg?.toLowerCase() || ''; // NOTE: DOMPurify anti-tamper mechanism requires us to clone the string
// calling any method whatsoever on a string will cause the string to be tampered
// and DOMPurify will return empty strings
const lowerCase = String(arg || '').toLowerCase();
for (const forbiddenElement of forbiddenElements) { for (const forbiddenElement of forbiddenElements) {
if (lowerCase.includes('<' + forbiddenElement)) { if (lowerCase.includes('<' + forbiddenElement)) {
logWarning(`Plugin ${pluginId} tried to set ${forbiddenElement} in innerHTML`, { logWarning(`Plugin ${pluginId} tried to set ${forbiddenElement} in innerHTML`, {
@@ -223,7 +226,7 @@ function distortInnerHTML(distortions: DistortionMap) {
} }
if (isFunction(originalMethod)) { if (isFunction(originalMethod)) {
originalMethod.apply(this, args); return originalMethod.apply(this, args);
} }
}; };
} }