XSS: Option to disable and / or sanitize html in text panels

[torkelo]

Text panels can contain any html and therefore pose an XSS security problem.

Grafana should come with a backend option to disable and or sanitize html in text panels.

[jokerlee]

This issue actually happened on our grafana. We write some urls to elastic search, then printed as legend in grafana, then XSS happens. This xss vulnerability can be used as a penetration attacks method.

[torkelo]

@jokerlee what version of Grafana are you using? The graph legend html encodes the series name so the XSS should not be possible in that case

[tehmaspc]

Any updates or plans on fixing this?

[michaeltravisuk]

I would also like to see this fixed, including as a configurable option.

[z0vsky]

Any updates on this?
An attacker (or a malevolent user) having access to a Grafana instance could create a malicious panel as an attack vector to execute arbitrary JavaScript code on victim's browsers.