From b86d371aab4bc7ff320b732e9d392a1e2ffb6226 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Mon, 10 May 2021 20:33:17 +0100
Subject: [PATCH] Sanitize PromLink button (#33874) (#33876)

(cherry picked from commit 7b5223bf197a37273cc445db70faa04396bef07f)

Co-authored-by: Ivana Huckova <30407135+ivanahuckova@users.noreply.github.com>
---
 .../prometheus/components/PromLink.test.tsx          | 12 ++++++++++++
 .../datasource/prometheus/components/PromLink.tsx    |  4 ++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx b/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
index 7087b7d79de..1f05f8a9bae 100644
--- a/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
+++ b/public/app/plugins/datasource/prometheus/components/PromLink.test.tsx
@@ -64,4 +64,16 @@ describe('PromLink', () => {
       'prom2/graph?g0.expr=up&g0.range_input=0s&g0.end_input=undefined&g0.step_input=15&g0.tab=0'
     );
   });
+  it('should create sanitized link', async () => {
+    render(
+      <div>
+        <PromLink
+          datasource={getDataSource({ directUrl: "javascript:300?1:2;alert('Hello');//" })}
+          panelData={getPanelData()}
+          query={{} as PromQuery}
+        />
+      </div>
+    );
+    expect(screen.getByText('Prometheus')).toHaveAttribute('href', 'about:blank');
+  });
 });
diff --git a/public/app/plugins/datasource/prometheus/components/PromLink.tsx b/public/app/plugins/datasource/prometheus/components/PromLink.tsx
index b88c2072909..a2986a260aa 100644
--- a/public/app/plugins/datasource/prometheus/components/PromLink.tsx
+++ b/public/app/plugins/datasource/prometheus/components/PromLink.tsx
@@ -3,7 +3,7 @@ import React, { FC, useEffect, useState, memo } from 'react';
 
 import { PrometheusDatasource } from '../datasource';
 import { PromQuery } from '../types';
-import { DataQueryRequest, PanelData } from '@grafana/data';
+import { DataQueryRequest, PanelData, textUtil } from '@grafana/data';
 
 interface Props {
   datasource: PrometheusDatasource;
@@ -54,7 +54,7 @@ const PromLink: FC<Props> = ({ panelData, query, datasource }) => {
   }, [panelData]);
 
   return (
-    <a href={href} target="_blank" rel="noopener noreferrer">
+    <a href={textUtil.sanitizeUrl(href)} target="_blank" rel="noopener noreferrer">
       Prometheus
     </a>
   );