From dda21296ddeb4cd6ed068ac602e64f12fcae3500 Mon Sep 17 00:00:00 2001 From: Ryan McKinley Date: Wed, 1 Feb 2023 00:58:37 -0800 Subject: [PATCH] Geomap: Sanitize the attribution string (#745) * SAML: Update grafana/saml library (#691) Co-authored-by: jguer * SVG: Add dompurify preprocessor step (#698) * add sanitized SVG component * add sanitize * Fix frontend build * Remove unnecessary yarn.lock changes * Fix formatting * Re-add yarn.lock message as I guess it is needed --------- Co-authored-by: dsotirakis Co-authored-by: jguer Co-authored-by: nmarrs Co-authored-by: Drew Slobodnjak <60050885+drew08t@users.noreply.github.com> (cherry picked from commit 37b4af7ffacfc24d5f24d190356a9ef32d99aa6f) --- public/app/plugins/panel/geomap/utils/layers.ts | 6 +++++- yarn.lock | 6 +++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/public/app/plugins/panel/geomap/utils/layers.ts b/public/app/plugins/panel/geomap/utils/layers.ts index 6e9d5995aa7..75a2357c388 100644 --- a/public/app/plugins/panel/geomap/utils/layers.ts +++ b/public/app/plugins/panel/geomap/utils/layers.ts @@ -2,7 +2,7 @@ import { Map as OpenLayersMap } from 'ol'; import { FeatureLike } from 'ol/Feature'; import { Subject } from 'rxjs'; -import { getFrameMatchers, MapLayerHandler, MapLayerOptions, PanelData } from '@grafana/data/src'; +import { getFrameMatchers, MapLayerHandler, MapLayerOptions, PanelData, textUtil } from '@grafana/data'; import { config } from '@grafana/runtime/src'; import { GeomapPanel } from '../GeomapPanel'; @@ -114,6 +114,10 @@ export async function initLayer( return Promise.reject('unknown layer: ' + options.type); } + if (options.config?.attribution) { + options.config.attribution = textUtil.sanitizeTextPanelContent(options.config.attribution); + } + const handler = await item.create(map, options, panel.props.eventBus, config.theme2); const layer = handler.init(); // eslint-disable-line if (options.opacity != null) { diff --git a/yarn.lock b/yarn.lock index 9335e109725..8b3c507a97f 100644 --- a/yarn.lock +++ b/yarn.lock @@ -18187,9 +18187,9 @@ __metadata: linkType: hard "dompurify@npm:^2.4.1": - version: 2.4.3 - resolution: "dompurify@npm:2.4.3" - checksum: b440981f2a38cada2085759cc3d1e2f94571afc34343d011a8a6aa1ad91ae6abf651adbfa4994b0e2283f0ce81f7891cdb04b67d0b234c8d190cb70e9691f026 + version: 2.4.1 + resolution: "dompurify@npm:2.4.1" + checksum: 1169177465b3cbb25a44322937fba549f6c4e1a91b83245d144471be26619c835cccf0f8e20aa78c25ac11a06efd17cc1b9db9cacadceb78a4c08a1029eafee5 languageName: node linkType: hard