From 125ba95686df79989626ac1e8aa48e582c0efd98 Mon Sep 17 00:00:00 2001
From: Rotem Reiss <reiss.r@gmail.com>
Date: Tue, 12 May 2020 14:19:00 +0300
Subject: [PATCH] Security: Tag value sanitization fix in OpenTSDB data source
 (#24539)

Adds HTML sanitization to the tag value of the OpenTSDB datasource.

Fixes #24537
---
 public/app/plugins/datasource/opentsdb/query_ctrl.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/app/plugins/datasource/opentsdb/query_ctrl.ts b/public/app/plugins/datasource/opentsdb/query_ctrl.ts
index 8569de2eb07..2365f026baa 100644
--- a/public/app/plugins/datasource/opentsdb/query_ctrl.ts
+++ b/public/app/plugins/datasource/opentsdb/query_ctrl.ts
@@ -2,6 +2,7 @@ import _ from 'lodash';
 import kbn from 'app/core/utils/kbn';
 import { QueryCtrl } from 'app/plugins/sdk';
 import { auto } from 'angular';
+import { textUtil } from '@grafana/data';
 
 export class OpenTsQueryCtrl extends QueryCtrl {
   static templateUrl = 'partials/query.editor.html';
@@ -90,7 +91,7 @@ export class OpenTsQueryCtrl extends QueryCtrl {
 
   getTextValues(metricFindResult: any) {
     return _.map(metricFindResult, value => {
-      return value.text;
+      return textUtil.escapeHtml(value.text);
     });
   }