From 6df113e412d8acb6426deedbb3a8012118b2c543 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Wed, 1 Feb 2023 13:41:40 -0500 Subject: [PATCH] [v9.2.x] Geomap: Sanitize the attribution string (#753) Geomap: Sanitize the attribution string (#745) * SAML: Update grafana/saml library (#691) Co-authored-by: jguer * SVG: Add dompurify preprocessor step (#698) * add sanitized SVG component * add sanitize * Fix frontend build * Remove unnecessary yarn.lock changes * Fix formatting * Re-add yarn.lock message as I guess it is needed --------- Co-authored-by: dsotirakis Co-authored-by: jguer Co-authored-by: nmarrs Co-authored-by: Drew Slobodnjak <60050885+drew08t@users.noreply.github.com> (cherry picked from commit 37b4af7ffacfc24d5f24d190356a9ef32d99aa6f) Co-authored-by: Ryan McKinley --- public/app/plugins/panel/geomap/utils/layers.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/public/app/plugins/panel/geomap/utils/layers.ts b/public/app/plugins/panel/geomap/utils/layers.ts index 4cd68d22a5d..2533ab9f5de 100644 --- a/public/app/plugins/panel/geomap/utils/layers.ts +++ b/public/app/plugins/panel/geomap/utils/layers.ts @@ -2,7 +2,7 @@ import { PluggableMap } from 'ol'; import { FeatureLike } from 'ol/Feature'; import { Subject } from 'rxjs'; -import { getFrameMatchers, MapLayerHandler, MapLayerOptions, PanelData } from '@grafana/data/src'; +import { getFrameMatchers, MapLayerHandler, MapLayerOptions, PanelData, textUtil } from '@grafana/data'; import { config } from '@grafana/runtime/src'; import { GeomapPanel } from '../GeomapPanel'; @@ -114,6 +114,10 @@ export async function initLayer( return Promise.reject('unknown layer: ' + options.type); } + if (options.config?.attribution) { + options.config.attribution = textUtil.sanitizeTextPanelContent(options.config.attribution); + } + const handler = await item.create(map, options, panel.props.eventBus, config.theme2); const layer = handler.init(); // eslint-disable-line if (options.opacity != null) {