From 561ca52ab3fb3cb4877ccb11da036ada4eb40253 Mon Sep 17 00:00:00 2001
From: Alexandra Vargas <alexa1866@gmail.com>
Date: Fri, 22 Oct 2021 17:40:31 +0200
Subject: [PATCH] NavBar: Add sanitize to children items

(cherry picked from commit a3dc30546fce2e437d858c140f1ff307a04365d6)
---
 public/app/core/components/NavBar/DropdownChild.tsx | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/public/app/core/components/NavBar/DropdownChild.tsx b/public/app/core/components/NavBar/DropdownChild.tsx
index abd9c95d6f2..ef229ff92c2 100644
--- a/public/app/core/components/NavBar/DropdownChild.tsx
+++ b/public/app/core/components/NavBar/DropdownChild.tsx
@@ -1,6 +1,6 @@
 import React from 'react';
 import { css } from '@emotion/css';
-import { GrafanaTheme2 } from '@grafana/data';
+import { GrafanaTheme2, textUtil } from '@grafana/data';
 import { Icon, IconName, Link, useTheme2 } from '@grafana/ui';
 
 export interface Props {
@@ -34,13 +34,15 @@ const DropdownChild = ({ isDivider = false, icon, onClick, target, text, url }:
     </button>
   );
   if (url) {
+    const sanitizedUrl = textUtil.sanitizeAngularInterpolation(url);
+
     element =
       !target && url.startsWith('/') ? (
-        <Link className={styles.element} onClick={onClick} href={url}>
+        <Link className={styles.element} onClick={onClick} href={sanitizedUrl}>
           {linkContent}
         </Link>
       ) : (
-        <a className={styles.element} href={url} target={target} rel="noopener" onClick={onClick}>
+        <a className={styles.element} href={sanitizedUrl} target={target} rel="noopener" onClick={onClick}>
           {linkContent}
         </a>
       );