Skip to content

Commit

Permalink
Graph: Fix XSS vulnerability with series overrides (#25401)
Browse files Browse the repository at this point in the history
* Fix XSS vulnerability with Graph series overrides

* Update public/app/plugins/datasource/testdata/partials/query.editor.html
  • Loading branch information
dprokop committed Jun 8, 2020
1 parent c7e38fd commit c53435f
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 4 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
</div>
<div class="gf-form max-width-15">
<label class="gf-form-label query-keyword">Alias</label>
<input type="text" class="gf-form-input" ng-model="ctrl.target.alias" spellcheck='false' placeholder="alias patterns" ng-blur="ctrl.refresh()">
<input type="text" class="gf-form-input" ng-model="ctrl.target.alias" spellcheck='false' placeholder="alias patterns" ng-blur="ctrl.refresh()" pattern='[^<>&\\"]+'>
</div>
</div>

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
</div>
<div class="gf-form">
<label class="gf-form-label query-keyword width-7">Alias</label>
<input type="text" class="gf-form-input width-14" placeholder="optional" ng-model="ctrl.target.alias" ng-change="ctrl.refresh()" ng-model-onblur>
<input type="text" class="gf-form-input width-14" placeholder="optional" ng-model="ctrl.target.alias" ng-model-onblur ng-change="ctrl.refresh()" pattern='[^<>&\\"]+'>
</div>
<div ng-if="ctrl.showLabels" class="gf-form gf-form--grow">
<label class="gf-form-label query-keyword width-7">
Expand Down Expand Up @@ -215,7 +215,7 @@
</div>
</div>


<div class="gf-form-inline" ng-if="ctrl.scenario.id === 'arrow'">
<div class="gf-form" style="width: 100%;">
<textarea type="string"
Expand Down
3 changes: 2 additions & 1 deletion public/app/plugins/panel/graph/series_overrides_ctrl.ts
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import _ from 'lodash';
import coreModule from 'app/core/core_module';
import { textUtil } from '@grafana/data';

/** @ngInject */
export function SeriesOverridesCtrl($scope: any, $element: JQuery, popoverSrv: any) {
Expand Down Expand Up @@ -79,7 +80,7 @@ export function SeriesOverridesCtrl($scope: any, $element: JQuery, popoverSrv: a

$scope.getSeriesNames = () => {
return _.map($scope.ctrl.seriesList, series => {
return series.alias;
return textUtil.escapeHtml(series.alias);
});
};

Expand Down

0 comments on commit c53435f

Please sign in to comment.