Sanitize datalinks urls

public/app/features/panel/panellinks/link_srv.ts

@@ -1,8 +1,10 @@
 import _ from 'lodash';
+import { sanitizeUrl } from '@braintree/sanitize-url';
 import { TimeSrv } from 'app/features/dashboard/services/TimeSrv';
 import templateSrv, { TemplateSrv } from 'app/features/templating/template_srv';
 import coreModule from 'app/core/core_module';
 import { appendQueryToUrl, toUrlParams } from 'app/core/utils/url';
+import { getConfig } from 'app/core/config';
 import { VariableSuggestion, VariableOrigin, DataLinkBuiltInVars } from '@grafana/ui';
 import { DataLink, KeyValue, deprecationWarning, LinkModel, DataFrame, ScopedVars } from '@grafana/data';
 
@@ -210,6 +212,7 @@ export class LinkSrv implements LinkService {
       },
     });
 
+    info.href = getConfig().disableSanitizeHtml ? info.href : sanitizeUrl(info.href);
     return info;
   };
 

public/app/features/panel/panellinks/specs/link_srv.test.ts

@@ -4,6 +4,7 @@ import _ from 'lodash';
 import { TimeSrv } from 'app/features/dashboard/services/TimeSrv';
 import { TemplateSrv } from 'app/features/templating/template_srv';
 import { advanceTo } from 'jest-date-mock';
+import { mockConfig } from '../../../../core/config';
 
 jest.mock('angular', () => {
   const AngularJSMock = require('test/mocks/angular');
@@ -137,4 +138,38 @@ describe('linkSrv', () => {
       ).toEqual('/d/1?time=1000000001');
     });
   });
+
+  describe('sanitization', () => {
+    const url = "javascript:alert('broken!);";
+    it.each`
+      disableSanitizeHtml | expected
+      ${true}             | ${url}
+      ${false}            | ${'about:blank'}
+    `(
+      "when disable disableSanitizeHtml set to '$disableSanitizeHtml' then result should be '$expected'",
+      ({ disableSanitizeHtml, expected }) => {
+        const restoreConfig = mockConfig({
+          disableSanitizeHtml,
+        });
+
+        const link = linkSrv.getDataLinkUIModel(
+          {
+            title: 'Any title',
+            url,
+          },
+          {
+            __value: {
+              value: { time: dataPointMock.datapoint[0] },
+              text: 'Value',
+            },
+          },
+          {}
+        ).href;
+
+        // console.log(link);
+        expect(link).toBe(expected);
+        restoreConfig();
+      }
+    );
+  });
 });