| " +
` | ` +
@@ -162,7 +162,7 @@ export function generateMultiLineTooltipContent(d, xFormatter, yFormatters) {
tooltip += '';
- return tooltip;
+ return dompurify.sanitize(tooltip);
}
export function generateTimePivotTooltip(d, xFormatter, yFormatter) {
@@ -223,7 +223,7 @@ export function generateBubbleTooltipContent({
s += createHTMLRow(getLabel(sizeField), sizeFormatter(point.size));
s += '';
- return s;
+ return dompurify.sanitize(s);
}
// shouldRemove indicates whether the nvtooltips should be removed from the DOM
@@ -262,11 +262,16 @@ export function wrapTooltip(chart) {
: chart;
const tooltipGeneratorFunc = tooltipLayer.tooltip.contentGenerator();
tooltipLayer.tooltip.contentGenerator(d => {
- let tooltip = ``;
- tooltip += tooltipGeneratorFunc(d);
- tooltip += '
';
-
- return tooltip;
+ // The nvd3-fork default contentGenerator builds tooltip HTML with
+ // unescaped series keys (and feeds them into the tooltip's `.html()`
+ // sink at render time). Run the final string through DOMPurify so
+ // charts that do NOT install a custom contentGenerator (Line, Bar,
+ // Area, Pie, BoxPlot, etc.) cannot execute stored payloads in
+ // column or series names. Custom contentGenerators set elsewhere in
+ // this module already return sanitized output, making this a
+ // belt-and-braces wrap.
+ const tooltip = `${tooltipGeneratorFunc(d)}
`;
+ return dompurify.sanitize(tooltip);
});
}
@@ -279,17 +284,19 @@ export function tipFactory(layer) {
if (!d) {
return '';
}
- const title =
+ const rawTitle =
d[layer.titleColumn] && d[layer.titleColumn].length > 0
? `${d[layer.titleColumn]} - ${layer.name}`
: layer.name;
- const body = Array.isArray(layer.descriptionColumns)
+ const rawBody = Array.isArray(layer.descriptionColumns)
? layer.descriptionColumns.map(c => d[c])
: Object.values(d);
- return `${title}
${body.join(
- ', ',
- )}
`;
+ return dompurify.sanitize(
+ `${rawTitle}
${rawBody.join(
+ ', ',
+ )}
`,
+ );
});
}
diff --git a/superset-frontend/plugins/legacy-preset-chart-nvd3/test/utils.test.ts b/superset-frontend/plugins/legacy-preset-chart-nvd3/test/utils.test.ts
index a883d4c6b7f4..a20fa38411c5 100644
--- a/superset-frontend/plugins/legacy-preset-chart-nvd3/test/utils.test.ts
+++ b/superset-frontend/plugins/legacy-preset-chart-nvd3/test/utils.test.ts
@@ -24,8 +24,11 @@ import {
import {
computeYDomain,
+ generateBubbleTooltipContent,
+ generateMultiLineTooltipContent,
getTimeOrNumberFormatter,
formatLabel,
+ tipFactory,
} from '../src/utils';
const DATA = [
@@ -181,4 +184,96 @@ describe('nvd3/utils', () => {
]);
});
});
+
+ // ------------------------------------------------------------------
+ // Tooltip HTML sanitisation (XSS regression).
+ // Each helper below feeds user-controlled column values into a
+ // d3 / nvd3 .html() sink; the sanitised return must strip dangerous
+ // markup so a stored payload cannot execute on hover.
+ // ------------------------------------------------------------------
+
+ describe('generateBubbleTooltipContent() sanitises user input', () => {
+ test('strips ',
+ x: 1,
+ y: 2,
+ size: 3,
+ },
+ entity: 'entity',
+ xField: 'x',
+ yField: 'y',
+ sizeField: 'size',
+ xFormatter: (v: number) => String(v),
+ yFormatter: (v: number) => String(v),
+ sizeFormatter: (v: number) => String(v),
+ });
+ expect(html).not.toMatch(/',
+ color: 'red',
+ value: 1,
+ },
+ ],
+ },
+ (v: number) => String(v),
+ [(v: number) => String(v)],
+ );
+ expect(html).not.toMatch(/payload',
+ };
+ const html = tip.html()(datum);
+ expect(html).not.toMatch(/'
+
+ link = str(dash.dashboard_link())
+
+ # The injected script tag / attribute breakout must be escaped away.
+ assert ""',
+ header_data={
+ "notification_format": "PNG",
+ "notification_type": "Alert",
+ "owners": [1],
+ "notification_source": None,
+ "chart_id": None,
+ "dashboard_id": None,
+ "slack_channels": None,
+ "execution_id": "test-execution-id",
+ },
+ )
+ email_body = (
+ EmailNotification(
+ recipient=ReportRecipients(type=ReportRecipientType.EMAIL), content=content
+ )
+ ._get_content()
+ .body
+ )
+
+ # Injected markup in the error text must be stripped, not rendered.
+ assert "" not in email_body
+ assert "onerror=alert(1)" not in email_body
+
+
@with_feature_flags(DATE_FORMAT_IN_EMAIL_SUBJECT=True)
def test_email_subject_with_datetime() -> None:
# `superset.models.helpers`, a dependency of following imports,
diff --git a/tests/unit_tests/sql/parse_tests.py b/tests/unit_tests/sql/parse_tests.py
index 0b83dd71dbd2..27c293229705 100644
--- a/tests/unit_tests/sql/parse_tests.py
+++ b/tests/unit_tests/sql/parse_tests.py
@@ -1166,6 +1166,30 @@ def test_has_mutation(engine: str, sql: str, expected: bool) -> None:
assert SQLScript(sql, engine).has_mutation() == expected
+@pytest.mark.parametrize(
+ "engine, sql, expected",
+ [
+ # Plain SELECT parses to a proper AST node.
+ ("postgresql", "SELECT * FROM foo", False),
+ # CALL parses to ``exp.Command`` on Postgres.
+ ("postgresql", "CALL my_proc(1);", True),
+ # A script that mixes a parseable statement with an unparseable one
+ # is still flagged so strict scoping can refuse the whole script.
+ ("postgresql", "SELECT 1; CALL my_proc();", True),
+ # Non-sqlglot engines (e.g. Kusto KQL) do not produce a parseable
+ # AST and cannot have their tables enumerated, so they must be
+ # flagged as unparseable to fail closed under strict scoping.
+ ("kustokql", "print 1", True),
+ ],
+)
+def test_has_unparseable_statement(engine: str, sql: str, expected: bool) -> None:
+ """
+ Test the `has_unparseable_statement` property used by strict scoping to
+ refuse statements that sqlglot couldn't fully model.
+ """
+ assert SQLScript(sql, engine).has_unparseable_statement is expected
+
+
@pytest.mark.parametrize(
"sql",
[