From 8f35683ccbbb234d8f1598c9bc416475172c05db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torkel=20=C3=96degaard?= <torkel.odegaard@gmail.com>
Date: Fri, 21 Aug 2015 10:17:02 +0200
Subject: [PATCH] fix(annotations): Fixed issue when html sanitizer failes for
 title to annotation body, now fallbacks to html escaping title and text,
 fixes #2563

---
 CHANGELOG.md                                      |  1 +
 public/app/directives/annotationTooltip.js        | 15 +++++++++++++--
 public/app/features/annotations/annotationsSrv.js |  2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce550aeb4aa..418e0583677 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ it allows you to add queries of differnet data source types & instances to the s
 - [Issue #2568](https://github.com/grafana/grafana/issues/2568). AuthProxy: Fix for server side rendering of panel when using auth proxy
 - [Issue #2490](https://github.com/grafana/grafana/issues/2490). Graphite: Dashboard import was broken in 2.1 and 2.1.1, working now
 - [Issue #2565](https://github.com/grafana/grafana/issues/2565). TimePicker: Fix for when you applied custom time range it did not refreh dashboard
+- [Issue #2563](https://github.com/grafana/grafana/issues/2563). Annotations: Fixed issue when html sanitizer failes for title to annotation body, now fallbacks to html escaping title and text
 
 **Breaking Changes**
 - Notice to makers/users of custom data sources, there is a minor breaking change in 2.2 that
diff --git a/public/app/directives/annotationTooltip.js b/public/app/directives/annotationTooltip.js
index 25059d08274..f75f05a6715 100644
--- a/public/app/directives/annotationTooltip.js
+++ b/public/app/directives/annotationTooltip.js
@@ -9,17 +9,28 @@ function (angular, $, _) {
   angular
   .module('grafana.directives')
   .directive('annotationTooltip', function($sanitize, dashboardSrv, $compile) {
+
+    function sanitizeString(str) {
+      try {
+        return $sanitize(str);
+      }
+      catch(err) {
+        console.log('Could not sanitize annotation string, html escaping instead');
+        return _.escape(str);
+      }
+    }
+
     return {
       link: function (scope, element) {
         var event = scope.event;
-        var title = $sanitize(event.title);
+        var title = sanitizeString(event.title);
         var dashboard = dashboardSrv.getCurrent();
         var time = '<i>' + dashboard.formatDate(event.min) + '</i>';
 
         var tooltip = '<div class="graph-tooltip small"><div class="graph-tooltip-time">' + title + ' ' + time + '</div> ' ;
 
         if (event.text) {
-          var text = $sanitize(event.text);
+          var text = sanitizeString(event.text);
           tooltip += text.replace(/\n/g, '<br>') + '<br>';
         }
 
diff --git a/public/app/features/annotations/annotationsSrv.js b/public/app/features/annotations/annotationsSrv.js
index a4529de2019..671b5d806cc 100644
--- a/public/app/features/annotations/annotationsSrv.js
+++ b/public/app/features/annotations/annotationsSrv.js
@@ -62,7 +62,7 @@ define([
         min: options.time,
         max: options.time,
         eventType: options.annotation.name,
-        title: options.title,
+        title: 'Torkel <test@asd.com>',//  options.title,
         tags: options.tags,
         text: options.text,
         score: 1