Skip to content

N
nexpie-grafana-theme
Commit 7a407740 by Torkel Ödegaard
Options

Annotations: added html sanitation to prevent markup injection/XSS, Closes #1121

parent 9594effb
Showing with 15 additions and 14 deletions
src/app/app.js
...@@ -9,6 +9,7 @@ define([ ...@@ -9,6 +9,7 @@ define([
'config', 'config',
'bootstrap', 'bootstrap',
'angular-route', 'angular-route',
'angular-sanitize',
'angular-strap', 'angular-strap',
'angular-dragdrop', 'angular-dragdrop',
'extend-jquery', 'extend-jquery',
...@@ -61,6 +62,7 @@ function (angular, $, _, appLevelRequire, config) { ...@@ -61,6 +62,7 @@ function (angular, $, _, appLevelRequire, config) {
var apps_deps = [ var apps_deps = [
'ngRoute', 'ngRoute',
'ngSanitize',
'$strap.directives', '$strap.directives',
'ang-drag-drop', 'ang-drag-drop',
'grafana', 'grafana',
......
src/app/components/require.config.js
...@@ -17,6 +17,7 @@ require.config({ ...@@ -17,6 +17,7 @@ require.config({
filesaver: '../vendor/filesaver', filesaver: '../vendor/filesaver',
angular: '../vendor/angular/angular', angular: '../vendor/angular/angular',
'angular-route': '../vendor/angular/angular-route', 'angular-route': '../vendor/angular/angular-route',
'angular-sanitize': '../vendor/angular/angular-sanitize',
'angular-dragdrop': '../vendor/angular/angular-dragdrop', 'angular-dragdrop': '../vendor/angular/angular-dragdrop',
'angular-strap': '../vendor/angular/angular-strap', 'angular-strap': '../vendor/angular/angular-strap',
timepicker: '../vendor/angular/timepicker', timepicker: '../vendor/angular/timepicker',
...@@ -86,15 +87,12 @@ require.config({ ...@@ -86,15 +87,12 @@ require.config({
'jquery.flot.time': ['jquery', 'jquery.flot'], 'jquery.flot.time': ['jquery', 'jquery.flot'],
'jquery.flot.crosshair':['jquery', 'jquery.flot'], 'jquery.flot.crosshair':['jquery', 'jquery.flot'],
'jquery.flot.fillbelow':['jquery', 'jquery.flot'], 'jquery.flot.fillbelow':['jquery', 'jquery.flot'],
'angular-cookies': ['angular'],
'angular-dragdrop': ['jquery', 'angular'], 'angular-dragdrop': ['jquery', 'angular'],
'angular-loader': ['angular'],
'angular-mocks': ['angular'], 'angular-mocks': ['angular'],
'angular-resource': ['angular'], 'angular-sanitize': ['angular'],
'angular-route': ['angular'], 'angular-route': ['angular'],
'angular-touch': ['angular'],
'bindonce': ['angular'],
'angular-strap': ['angular', 'bootstrap','timepicker', 'datepicker'], 'angular-strap': ['angular', 'bootstrap','timepicker', 'datepicker'],
'bindonce': ['angular'],
timepicker: ['jquery', 'bootstrap'], timepicker: ['jquery', 'bootstrap'],
datepicker: ['jquery', 'bootstrap'], datepicker: ['jquery', 'bootstrap'],
......
src/app/services/annotationsSrv.js
...@@ -7,7 +7,7 @@ define([ ...@@ -7,7 +7,7 @@ define([
var module = angular.module('grafana.services'); var module = angular.module('grafana.services');
module.service('annotationsSrv', function(datasourceSrv, $q, alertSrv, $rootScope) { module.service('annotationsSrv', function(datasourceSrv, $q, alertSrv, $rootScope, $sanitize) {
var promiseCached; var promiseCached;
var list = []; var list = [];
var timezone; var timezone;
...@@ -63,9 +63,11 @@ define([ ...@@ -63,9 +63,11 @@ define([
} }
function addAnnotation(options) { function addAnnotation(options) {
var tooltip = "<small><b>" + options.title + "</b><br/>"; var title = $sanitize(options.title);
var tooltip = "<small><b>" + title + "</b><br/>";
if (options.tags) { if (options.tags) {
tooltip += '<span class="tag label label-tag">' + (options.tags || '') + '</span><br/>'; var tags = $sanitize(options.tags);
tooltip += '<span class="tag label label-tag">' + (tags || '') + '</span><br/>';
} }
if (timezone === 'browser') { if (timezone === 'browser') {
...@@ -76,7 +78,8 @@ define([ ...@@ -76,7 +78,8 @@ define([
} }
if (options.text) { if (options.text) {
tooltip += options.text.replace(/\n/g, '<br/>'); var text = $sanitize(options.text);
tooltip += text.replace(/\n/g, '<br/>');
} }
tooltip += "</small>"; tooltip += "</small>";
......
src/test/test-main.js
...@@ -18,6 +18,7 @@ require.config({ ...@@ -18,6 +18,7 @@ require.config({
angular: '../vendor/angular/angular', angular: '../vendor/angular/angular',
'angular-route': '../vendor/angular/angular-route', 'angular-route': '../vendor/angular/angular-route',
'angular-sanitize': '../vendor/angular/angular-sanitize',
angularMocks: '../vendor/angular/angular-mocks', angularMocks: '../vendor/angular/angular-mocks',
'angular-dragdrop': '../vendor/angular/angular-dragdrop', 'angular-dragdrop': '../vendor/angular/angular-dragdrop',
'angular-strap': '../vendor/angular/angular-strap', 'angular-strap': '../vendor/angular/angular-strap',
...@@ -80,14 +81,11 @@ require.config({ ...@@ -80,14 +81,11 @@ require.config({
'jquery.flot.fillbelow':['jquery', 'jquery.flot'], 'jquery.flot.fillbelow':['jquery', 'jquery.flot'],
'angular-route': ['angular'], 'angular-route': ['angular'],
'angular-cookies': ['angular'], 'angular-sanitize': ['angular'],
'angular-dragdrop': ['jquery', 'angular'], 'angular-dragdrop': ['jquery', 'angular'],
'angular-loader': ['angular'],
'angular-mocks': ['angular'], 'angular-mocks': ['angular'],
'angular-resource': ['angular'],
'angular-touch': ['angular'],
'bindonce': ['angular'],
'angular-strap': ['angular', 'bootstrap','timepicker', 'datepicker'], 'angular-strap': ['angular', 'bootstrap','timepicker', 'datepicker'],
'bindonce': ['angular'],
'bootstrap-tagsinput': ['jquery'], 'bootstrap-tagsinput': ['jquery'],
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment