Conversation
… stored XSS This change addresses a reported stored XSS vulnerability in the legacy Partition chart. User-controlled values (metrics and dimension names) were being interpolated directly into the tooltip HTML without sanitization. Changes: - Implemented `escapeHtml` helper function in `Partition.ts`. - Updated `positionAndPopulate` function to escape `n.name`, `n.disp`, `d.name`, `d.disp`, and category labels before inserting them into the tooltip. - Added a regression test `Partition.test.ts` that verifies the fix by asserting that an XSS payload is properly escaped. - Updated `jest.config.js` to include `d3-hierarchy` in `transformIgnorePatterns` to allow Jest to transform the ES module used by the plugin, enabling the new test to run. Co-authored-by: sha174n <105581038+sha174n@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
- Fix Stored XSS in legacy Partition chart by HTML-escaping user-controlled tooltip values. - Add regression test `Partition.test.ts`. - Update `package.json` overrides for `core-js` (to ^3.48.0) and `@noble/hashes` (to ^1.8.0) to resolve conflicts with `superset-ui-core` and other deps. - Update `package-lock.json` via `npm install` to sync with new overrides and fix CI `npm ci` failures. - Update `jest.config.js` to whitelist `d3-hierarchy` for transformation. Co-authored-by: sha174n <105581038+sha174n@users.noreply.github.com>
…scape Refactors the tooltip HTML generation to sanitize user-controlled values (metrics, dimensions) using `lodash.escape`. Also fixes CI build issues by updating `superset-frontend/package.json` overrides and synchronizing `package-lock.json`. Adds a regression test in `superset-frontend/plugins/legacy-plugin-chart-partition/test/Partition.test.ts`. Co-authored-by: sha174n <105581038+sha174n@users.noreply.github.com>
…scape Refactors the tooltip HTML generation to sanitize user-controlled values (metrics, dimensions) using `lodash.escape`. Also fixes CI build issues by updating `superset-frontend/package.json` overrides and synchronizing `package-lock.json`. Adds a regression test in `superset-frontend/plugins/legacy-plugin-chart-partition/test/Partition.test.ts`. Co-authored-by: sha174n <105581038+sha174n@users.noreply.github.com>
1 participant
This PR fixes a stored XSS vulnerability in the legacy Partition chart plugin. The vulnerability allowed malicious scripts injected into dimension values to execute when a user hovered over the chart segments.
I have verified the fix with a new regression test
superset-frontend/plugins/legacy-plugin-chart-partition/test/Partition.test.tswhich reproduces the issue and confirms the fix (asserting escaped HTML output).I also had to update
superset-frontend/jest.config.jsto allowd3-hierarchy(a dependency of the plugin) to be processed by Jest, as it is distributed as an ES module. This was necessary to run the tests for this plugin.PR created automatically by Jules for task 15948119334882233987 started by @sha174n